diff --git a/hosts/tsumugi/arr/default.nix b/hosts/tsumugi/arr/default.nix
index 49798cb..1681c7d 100644
--- a/hosts/tsumugi/arr/default.nix
+++ b/hosts/tsumugi/arr/default.nix
@@ -14,6 +14,7 @@
   ];
 
   sops.secrets."tsumugi/autobrrSecret" = { };
+  sops.secrets."tsumugi/autobrrEnv" = { };
   sops.secrets."tsumugi/bandcampCookies" = {
     owner = config.users.users.bandcampsync.name;
     restartUnits = [ "bandcampsync.service" ];
@@ -33,32 +34,48 @@
 
     prowlarr = {
       enable = true;
-      openFirewall = false; # 9696
-      settings.auth.method = "External";
+      openFirewall = false;
+      settings = {
+        auth.method = "External";
+        server.port = 9696;
+      };
     };
-    bazarr = {
+
+    flaresolverr = {
       enable = true;
-      openFirewall = false; # 6767
+      openFirewall = false;
+      port = 8191;
     };
-    seerr = {
+
+    bazarr = {
       enable = true;
-      port = 5055;
       openFirewall = false;
+      listenPort = 6767;
     };
 
-    recyclarr = {
+    seerr = {
       enable = true;
+      openFirewall = false;
+      port = 5055;
     };
 
+    recyclarr.enable = true;
+
     autobrr = {
       enable = true;
-      openFirewall = true; # 7474
+      openFirewall = false;
       secretFile = config.sops.secrets."tsumugi/autobrrSecret".path;
       settings = {
         host = "0.0.0.0";
         port = 7474;
+        oidcEnabled = true;
+        oidcIssuer = "https://auth.moppu.dev";
+        oidcRedirectUrl = "https://autobrr.moppu.dev/api/auth/oidc/callback";
+        oidcDisableBuiltInLogin = true;
       };
     };
+    systemd.services.autobrr.serviceConfig.EnvironmentFile =
+      config.sops.secrets."tsumugi/autobrrEnv".path;
 
     bandcampsync = {
       enable = true;
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 043bb97..4a2fd52 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -9,6 +9,7 @@ tsumugi:
     transmissionwgpk: ENC[AES256_GCM,data:qcV7E4am5kyg0Es4z98F8pECwbrnnw4J+wKIPkCuvGFEsR7g2ASBCqLlzs0=,iv:Pga7HS8+ZjNnghfx+GmQatLUBqL2pt5rt1VmGddkZDw=,tag:yKv92JQ0YAKlHu3JB2xpKw==,type:str]
     transmission: ENC[AES256_GCM,data:lUOP1FgucJ/Qi2nCx3SlZ5X36akHdHKa9ZA1H0JuBrqbyxAogRQJayLd606QNk8QE5Cecrg+el9/njKawWfB,iv:qpHSlLVKskSwW33iOwvINNnEidbQGqxBNjDdzNF7Y7Y=,tag:f7+mPCIvGqBA3t8EfATAew==,type:str]
     autobrrSecret: ENC[AES256_GCM,data:F3WlaDlhlzFL6ix/stAZIg==,iv:j4EaVIRc6LhqwIGbCEzEFGzKqOd/cfvSI/DgFoAlzDk=,tag:JmpWL0CNydnuluO7x9SRwg==,type:str]
+    autobrrEnv: ENC[AES256_GCM,data:QilX5sm8Fc+DSGBZuxa/dU6UtYQmPr/niRJUofR1Dm0odh7GCviwBu2S,iv:htjPOBGq0OFa+Ji5AKQC6/3lnpjCp2bKZqInf98SD+E=,tag:oYElFz9+sNj4coM7el5jEQ==,type:str]
     nutPass: ENC[AES256_GCM,data:jCJ9IEdtRVPy1NfcHUIwqnQ3rsc=,iv:Zafd/x8TOyWwKHAcGK41hZeWu/krb1ErzUo1ei2JqcA=,tag:WZfDmzVIsJ6hQ9Z+UfCvjg==,type:str]
     radarrMainApiKey: ENC[AES256_GCM,data:KX6ISlzv0DDdAOGUGAgHOoLGrv0Z0mo9KTz7W0BprlY=,iv:bb5CgT874g+5ExlSjCFnMFcp34LSkzGvmh6JdZ85pKs=,tag:9BR2O9SDPjsZ22xm6ADxRw==,type:str]
     radarrAnimeApiKey: ENC[AES256_GCM,data:Dn9LmPjgmGYlIoi0nV760R8v5nbu0iVtEO5rhgkpDGA=,iv:17YeBObcUP+AmAB2DHHRvgRZNfe2TdQ6+IsWV7qYqS8=,tag:1KLlrXSHM5CKZKP02KFSrw==,type:str]
@@ -77,7 +78,7 @@ sops:
             JFaroA1RPAmhCC0nSl4seBSIuRl8QrPjfcBJy4mFycll5Mp/0/WwLA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cpqgsevvfgk0nnmxacsdcwsrkefd0xcx7wkdlyaqj8vgvfvnm4rq4npjv6
-    lastmodified: "2026-08-13T13:01:25Z"
-    mac: ENC[AES256_GCM,data:raik4hSmc5j+KCGRAQo+k7C1y8nshN+uwFdJOQ0J49KLWP3+Rj6xh9lSXMBOixFfYavehRP4vR/GFkFh7DlJ+XCZJWZUxKay+WffFbb7frwFg4XIiCSaXlddy6tcKNrq3Fpmz0RDQeMM9u/QQKu3oF+3kJQrgo6IuRtkE7iv+wQ=,iv:p3ri96GxZMzEP29VS1wL5fibRseZZmzaptzhRssdJa4=,tag:7AkxQt15dIc9ZATzyvtMvw==,type:str]
+    lastmodified: "2026-08-20T12:59:45Z"
+    mac: ENC[AES256_GCM,data:DXCfq+Y0HNtPek7LGZ95JpvcjTlC9whqHdY+nns+xf5RXdOXTsSgFa6Wvdoh+HmPXQevaFg+XD4y8YMXIv4aXpE8Uw9so9gf4cxna1sK3FP7jzCtmr2ZJiQZTq/uFkBSwr09EAGqwUBOMxLMxEGEv6R+6oeUTn6C/3NCPhWKfQM=,iv:FD5+8apdl84VvWYj4SZRV0PbHwlU9UXwgzfrC31nIE0=,tag:5wRmBVUpgFUJQhX9qL9Kjw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3