diff --git a/backend/api/cloud.py b/backend/api/cloud.py
index dd9f32c..27c8194 100644
--- a/backend/api/cloud.py
+++ b/backend/api/cloud.py
@@ -940,6 +940,8 @@ async def list_cloud_folders(
 
 # ── PATCH /api/users/me/default-storage ──────────────────────────────────────
 
+_VALID_BACKENDS = frozenset({"minio", "google_drive", "onedrive", "nextcloud", "webdav"})
+
 
 @users_router.patch("/me/default-storage")
 @account_limiter.limit("100/minute")
@@ -951,9 +953,14 @@ async def update_default_storage(
 ) -> dict:
     """Update the current user's default storage backend.
 
-    The backend value is stored as-is (validated by the frontend dropdown).
+    The backend value is validated against the allowlist before storage.
     Returns the updated default_storage_backend value.
     """
+    if body.backend not in _VALID_BACKENDS:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=f"Invalid backend. Valid values: {sorted(_VALID_BACKENDS)}",
+        )
     request.state.current_user = current_user
     user = await session.get(User, current_user.id)
     if user is None: