diff --git a/milky-way/environments/stage00/orion-system/main.jsonnet b/milky-way/environments/stage00/orion-system/main.jsonnet
index 903f7a6..774a186 100644
--- a/milky-way/environments/stage00/orion-system/main.jsonnet
+++ b/milky-way/environments/stage00/orion-system/main.jsonnet
@@ -142,6 +142,7 @@ local secrets = import 'milky-way/secrets/k8s-secret-values.jsonnet';
   qbittorrent: qbittorrent.new(
     wireguardPrivateKey = wgConf.privateKeyOf(importstr 'milky-way/secrets/qbt-gluetun.conf'),
     tailscaleHostname = "qbittorrent",
+    vpnProvider = "protonvpn",
     serverCountries = "United States",
     volumeClaimName = this.mdataPvc.metadata.name,
     volumeMountPath = "/data",
diff --git a/milky-way/lib/gluetun.libsonnet b/milky-way/lib/gluetun.libsonnet
index 236098d..34fe648 100644
--- a/milky-way/lib/gluetun.libsonnet
+++ b/milky-way/lib/gluetun.libsonnet
@@ -27,9 +27,9 @@ local images = import 'milky-way/lib/images.libsonnet';
     openvpnPassword=null,
     name='gluetun',                     // container name + secret/configmap prefix
     namespace='default',
-    vpnProvider='nordvpn',
-    vpnType='wireguard',                // 'wireguard' (NordLynx) | 'openvpn'
-    serverCountries='United States',    // SERVER_COUNTRIES
+    vpnProvider,                        // required: must match the secret + support the features used (e.g. PF), e.g. 'protonvpn'
+    vpnType,                            // required: 'wireguard' | 'openvpn' -- must match the credentials below
+    serverCountries,                    // required: SERVER_COUNTRIES, e.g. 'United States'
     serverRegions=null,                 // optional SERVER_REGIONS
     tz='America/Los_Angeles',
     controlPort=8000,
diff --git a/milky-way/lib/qbittorrent.libsonnet b/milky-way/lib/qbittorrent.libsonnet
index d9c0b9b..99e29f4 100644
--- a/milky-way/lib/qbittorrent.libsonnet
+++ b/milky-way/lib/qbittorrent.libsonnet
@@ -27,8 +27,8 @@ local images = import 'milky-way/lib/images.libsonnet';
     image=images.qbittorrent.fullyQualifiedImageReferencePinned,
     webuiPort=8080,
     tailscaleHostname,                  // required, unique tailnet-wide -> https://<tailscaleHostname>.<tailnet>.ts.net
-    vpnProvider='protonvpn',            // must support port forwarding for inbound peers (see header)
-    serverCountries='United States',
+    vpnProvider,                        // required: must support port forwarding for inbound peers (see header)
+    serverCountries,                    // required: SERVER_COUNTRIES, e.g. 'United States'
     configStorageClassName='my-custom-zfs-generic-iscsi',     // RWO
     configStorageSize='5Gi',
     volumeClaimName,                    // required -> external shared RWX PVC (defined in main.jsonnet)