diff --git a/docker_swarm/roles/media/docker-stack.yml.j2 b/docker_swarm/roles/media/docker-stack.yml.j2
index 76a1ded..fbdc776 100644
--- a/docker_swarm/roles/media/docker-stack.yml.j2
+++ b/docker_swarm/roles/media/docker-stack.yml.j2
@@ -49,30 +49,30 @@ volumes:
   jellyfin_cache:
 
 services:
-  prowlarr:
-    image: lscr.io/linuxserver/prowlarr:latest
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - TZ=Europe/Amsterdam
-    volumes:
-      - type: volume
-        source: prowlarr_config
-        target: /config
-        volume:
-          nocopy: true
-    networks:
-      - traefik
-    deploy:
-      labels:
-        - traefik.enable=true
-        - traefik.http.routers.prowlarr.entrypoints=localsecure
-        - traefik.http.routers.prowlarr.rule=Host(`prowlarr.kun.is`)
-        - traefik.http.routers.prowlarr.tls=true
-        - traefik.http.routers.prowlarr.tls.certresolver=letsencrypt
-        - traefik.http.routers.prowlarr.service=prowlarr
-        - traefik.http.services.prowlarr.loadbalancer.server.port=9696
-        - traefik.docker.network=traefik
+  # prowlarr:
+  #   image: lscr.io/linuxserver/prowlarr:latest
+  #   environment:
+  #     - PUID=1000
+  #     - PGID=1000
+  #     - TZ=Europe/Amsterdam
+  #   volumes:
+  #     - type: volume
+  #       source: prowlarr_config
+  #       target: /config
+  #       volume:
+  #         nocopy: true
+  #   networks:
+  #     - traefik
+  #   deploy:
+  #     labels:
+  #       - traefik.enable=true
+  #       - traefik.http.routers.prowlarr.entrypoints=localsecure
+  #       - traefik.http.routers.prowlarr.rule=Host(`prowlarr.kun.is`)
+  #       - traefik.http.routers.prowlarr.tls=true
+  #       - traefik.http.routers.prowlarr.tls.certresolver=letsencrypt
+  #       - traefik.http.routers.prowlarr.service=prowlarr
+  #       - traefik.http.services.prowlarr.loadbalancer.server.port=9696
+  #       - traefik.docker.network=traefik
 
   sonarr:
     image: lscr.io/linuxserver/sonarr:latest
diff --git a/docker_swarm/roles/traefik/docker-stack.yml.j2 b/docker_swarm/roles/traefik/docker-stack.yml.j2
index fc9e32a..e29ed3c 100644
--- a/docker_swarm/roles/traefik/docker-stack.yml.j2
+++ b/docker_swarm/roles/traefik/docker-stack.yml.j2
@@ -144,6 +144,12 @@ services:
         - traefik.http.routers.radarr.rule=Host(`radarr.kun.is`)
         - traefik.http.routers.radarr.tls=true
         - traefik.http.routers.radarr.tls.certresolver=letsencrypt
+
+        - traefik.http.routers.prowlarr.entrypoints=localsecure
+        - traefik.http.routers.prowlarr.service=k3s@file
+        - traefik.http.routers.prowlarr.rule=Host(`prowlarr.kun.is`)
+        - traefik.http.routers.prowlarr.tls=true
+        - traefik.http.routers.prowlarr.tls.certresolver=letsencrypt
     volumes:
       - type: bind
         source: /var/run/docker.sock
diff --git a/nix/flake/kubenix/media.nix b/nix/flake/kubenix/media.nix
index 53a409f..cac5414 100644
--- a/nix/flake/kubenix/media.nix
+++ b/nix/flake/kubenix/media.nix
@@ -18,6 +18,12 @@
         PGID = "1000";
         TZ = "Europe/Amsterdam";
       };
+
+      prowlarr-env.data = {
+        PUID = "1000";
+        PGID = "1000";
+        TZ = "Europe/Amsterdam";
+      };
     };
 
     deployments = {
@@ -236,6 +242,49 @@
           };
         };
       };
+
+      prowlarr = {
+        metadata.labels = {
+          app = "media";
+          component = "prowlarr";
+        };
+
+        spec = {
+          selector.matchLabels = {
+            app = "media";
+            component = "prowlarr";
+          };
+
+          template = {
+            metadata.labels = {
+              app = "media";
+              component = "prowlarr";
+            };
+
+            spec = {
+              containers.prowlarr = {
+                image = "lscr.io/linuxserver/prowlarr:latest";
+                envFrom = [{ configMapRef.name = "prowlarr-env"; }];
+
+                ports = [{
+                  containerPort = 9696;
+                  protocol = "TCP";
+                }];
+
+                volumeMounts = [{
+                  name = "config";
+                  mountPath = "/config";
+                }];
+              };
+
+              volumes = [{
+                name = "config";
+                persistentVolumeClaim.claimName = "prowlarr-config";
+              }];
+            };
+          };
+        };
+      };
     };
 
     persistentVolumes = {
@@ -288,6 +337,16 @@
           path = "/mnt/data/nfs/radarr/config";
         };
       };
+
+      prowlarr-config.spec = {
+        capacity.storage = "1Mi";
+        accessModes = [ "ReadWriteMany" ];
+
+        nfs = {
+          server = "lewis.hyp";
+          path = "/mnt/data/nfs/prowlarr/config";
+        };
+      };
     };
 
     persistentVolumeClaims = {
@@ -325,6 +384,13 @@
         resources.requests.storage = "1Mi";
         volumeName = "radarr-config";
       };
+
+      prowlarr-config.spec = {
+        accessModes = [ "ReadWriteMany" ];
+        storageClassName = "";
+        resources.requests.storage = "1Mi";
+        volumeName = "prowlarr-config";
+      };
     };
 
     services = {
@@ -395,6 +461,19 @@
           targetPort = 7878;
         }];
       };
+
+      prowlarr.spec = {
+        selector = {
+          app = "media";
+          component = "prowlarr";
+        };
+
+        ports = [{
+          protocol = "TCP";
+          port = 80;
+          targetPort = 9696;
+        }];
+      };
     };
 
     ingresses = {
@@ -469,6 +548,24 @@
           }];
         }];
       };
+
+      prowlarr.spec = {
+        ingressClassName = "traefik";
+
+        rules = [{
+          host = "prowlarr.kun.is";
+
+          http.paths = [{
+            path = "/";
+            pathType = "Prefix";
+
+            backend.service = {
+              name = "prowlarr";
+              port.number = 80;
+            };
+          }];
+        }];
+      };
     };
   };
 }