diff --git a/ansible/roles/profile_backend_phase1/defaults/main.yml b/ansible/roles/profile_backend_phase1/defaults/main.yml
index c71015a..6933ef1 100644
--- a/ansible/roles/profile_backend_phase1/defaults/main.yml
+++ b/ansible/roles/profile_backend_phase1/defaults/main.yml
@@ -10,10 +10,13 @@ backend_phase1_firewalld_zone: public
 backend_phase1_npm_source_ip: CHANGEME_AEGIS_IP
 backend_phase1_syncthing_native_subnet: CHANGEME_LAN_SUBNET
 backend_phase1_music_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
+backend_phase1_archive_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_archive }}"
+backend_phase1_syncthing_folder_path: "{{ backend_phase1_archive_dir }}/Org"
 backend_phase1_app_data_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
 backend_phase1_navidrome_data_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"
 backend_phase1_syncthing_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
 backend_phase1_music_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
+backend_phase1_archive_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_archive }}"
 backend_phase1_app_data_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_app_data }}"
 backend_phase1_navidrome_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_navidrome }}"
 backend_phase1_syncthing_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_syncthing }}"
diff --git a/ansible/roles/profile_backend_phase1/tasks/main.yml b/ansible/roles/profile_backend_phase1/tasks/main.yml
index 1b4384c..3160934 100644
--- a/ansible/roles/profile_backend_phase1/tasks/main.yml
+++ b/ansible/roles/profile_backend_phase1/tasks/main.yml
@@ -13,6 +13,8 @@
           - backend_phase1_npm_source_ip != 'CHANGEME_AEGIS_IP'
           - backend_phase1_syncthing_native_subnet != 'CHANGEME_LAN_SUBNET'
           - backend_phase1_music_dir.startswith('/')
+          - backend_phase1_archive_dir.startswith('/')
+          - backend_phase1_syncthing_folder_path.startswith(backend_phase1_archive_dir + '/')
           - backend_phase1_app_data_root.startswith('/')
           - backend_phase1_navidrome_data_dir.startswith(backend_phase1_app_data_root + '/')
           - backend_phase1_syncthing_root.startswith(backend_phase1_app_data_root + '/')
@@ -52,6 +54,8 @@
       loop:
         - dataset: "{{ backend_phase1_music_dataset }}"
           mountpoint: "{{ backend_phase1_music_dir }}"
+        - dataset: "{{ backend_phase1_archive_dataset }}"
+          mountpoint: "{{ backend_phase1_archive_dir }}"
         - dataset: "{{ backend_phase1_app_data_dataset }}"
           mountpoint: "{{ backend_phase1_app_data_root }}"
         - dataset: "{{ backend_phase1_navidrome_dataset }}"
@@ -104,6 +108,8 @@
           mode: "0750"
         - path: "{{ backend_phase1_syncthing_root }}"
           mode: "0750"
+        - path: "{{ backend_phase1_syncthing_folder_path }}"
+          mode: "0770"
       loop_control:
         label: "{{ item.path }}"
 
diff --git a/ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2 b/ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2
index 5b96b0b..7ab5ca5 100644
--- a/ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2
+++ b/ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2
@@ -18,6 +18,8 @@ Environment=STHOMEDIR=/var/syncthing/config
 Environment=STGUIADDRESS=0.0.0.0:{{ backend_phase1_syncthing_gui_port }}
 Environment=TZ={{ backend_phase1_timezone }}
 Volume={{ backend_phase1_syncthing_root }}:/var/syncthing:Z
+# Archive is intentionally shared with Samba; use a shared SELinux container label.
+Volume={{ backend_phase1_archive_dir }}:/data:z
 NoNewPrivileges=true
 DropCapability=all