diff --git a/hosts/tsumugi/arr/default.nix b/hosts/tsumugi/arr/default.nix
index 99ce195..59f4562 100644
--- a/hosts/tsumugi/arr/default.nix
+++ b/hosts/tsumugi/arr/default.nix
@@ -89,6 +89,13 @@
 
     recyclarr.enable = true;
 
+    audiobookshelf = {
+      enable = true;
+      openFirewall = true;
+      host = "0.0.0.0";
+      port = 8000;
+    };
+
     bandcampsync = {
       enable = true;
       settings = {
diff --git a/hosts/tsumugi/arr/shelfarr.nix b/hosts/tsumugi/arr/shelfarr.nix
index 9de3d52..0862fcd 100644
--- a/hosts/tsumugi/arr/shelfarr.nix
+++ b/hosts/tsumugi/arr/shelfarr.nix
@@ -7,20 +7,29 @@
 }:
 let
   cfg = config.virtualisation.oci-containers.containers;
-  version = "2026.08.24.1";
+  version = "2026.08.31.1";
   ip = "100.109.197.202";
+  mountRoot = "/mnt/media/data";
   libationBooksPath = "/mnt/media/data/appdata/libation/books";
   shelfarrState = "/var/lib/shelfarr";
   libationState = "/var/lib/shelfarr-libation";
 in
 {
   sops.secrets."tsumugi/shelfarrEnv" = { };
+  users = {
+    groups.shelfarr = { };
+    users.shelfarr = {
+      description = "shelfarr user";
+      group = "shelfarr";
+      isSystemUser = true;
+    };
+  };
   systemd = {
     services.shelfarr.after = [ "mnt-media.mount" ];
     tmpfiles.rules = [
-      "d ${shelfarrState}/data 0700 root root -"
-      "d ${libationState}/config 0700 root root -"
-      "d ${libationState}/control 0700 root root -"
+      "d ${shelfarrState}/data 0700 shelfarr shelfarr -"
+      "d ${libationState}/config 0700 shelfarr shelfarr -"
+      "d ${libationState}/control 0700 shelfarr shelfarr -"
     ];
   };
   networking.firewall.trustedInterfaces = [ "podman0" ]; # allow access to host services
@@ -43,7 +52,6 @@ in
             serviceName = "shelfarr";
             hostname = "shelfarr";
             image = "ghcr.io/pedro-revez-silva/shelfarr:${version}";
-            # networks = [ "host" ];
             environment = {
               SOLID_QUEUE_IN_PUMA = "1";
               SHELFARR_LIBATION_URL = "http://shelfarr-libation:8080";
@@ -51,8 +59,8 @@ in
               SHELFARR_LIBATION_IMPORT_ROOT = "/imports/libation";
               # Keep these identical to the companion so both services can use the
               # read-only token and completed-backup volumes.
-              PUID = "1000";
-              PGID = "1000";
+              PUID = toString config.users.users.shelfarr.uid;
+              PGID = toString config.users.groups.shelfarr.gid;
               CHOWN_ON_START = "auto";
               TZ = "Europe/Dublin";
               # Optional: Change internal port (default: 80)
@@ -69,13 +77,7 @@ in
             volumes = [
               # Database and app storage (required - contains auto-generated secret key)
               "${shelfarrState}/data:/rails/storage"
-              # Audiobooks output folder (where Shelfarr places completed audiobooks)
-              "/mnt/media/data/media/audiobooks:/audiobooks"
-              # Ebooks output folder (where Shelfarr places completed ebooks)
-              "/mnt/media/data/media/ebooks:/ebooks"
-              # Download client completed folder (where downloads land before processing)
-              "/mnt/media/data/appdata/shelfarr/downloads:/downloads"
-              "/mnt/media/data/torrents/shelfarr:/transmission"
+              "${mountRoot}:${mountRoot}"
               # Completed Audible backups from the optional Libation companion
               "${libationBooksPath}:${cfg.shelfarr.environment.SHELFARR_LIBATION_IMPORT_ROOT}:ro"
               # Read-only bridge credential generated by the companion