diff --git a/roles/send/tasks/main.yml b/roles/send/tasks/main.yml
index 9ed8dd8..2ed91c9 100644
--- a/roles/send/tasks/main.yml
+++ b/roles/send/tasks/main.yml
@@ -2,6 +2,20 @@
 ---
 # tasks file for send
 
+- name: Assert S3 backend configuration when enabled
+  ansible.builtin.assert:
+    that:
+      - send_s3_endpoint | length > 0
+      - send_s3_bucket | length > 0
+      - send_s3_access_key | length > 0
+      - send_s3_secret_key | length > 0
+    fail_msg: >-
+      send_storage_backend is 's3' but one or more of send_s3_endpoint,
+      send_s3_bucket, send_s3_access_key, send_s3_secret_key is unset.
+      Provide via OpenBao, Ansible Vault or extra-vars — or switch
+      send_storage_backend to 'local'.
+  when: send_storage_backend == "s3"
+
 - name: Create docker compose directory
   ansible.builtin.file:
     path: "{{ send_docker_compose_dir }}"