diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
index 8c41b2d..ec27225 100644
--- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml
+++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
@@ -30,6 +30,15 @@ spec:
         # VPN container — must come first so network is up before qBittorrent starts
         - name: gluetun
           image: ghcr.io/qdm12/gluetun:latest
+          # Clean up stale ip rules before starting — handles both pod restarts and container-only restarts
+          # (initContainer only runs on pod restart; this command runs on every container start)
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              ip rule del priority 101 2>/dev/null || true
+              ip route flush table 51820 2>/dev/null || true
+              ip rule del table 51820 2>/dev/null || true
+              exec /gluetun
           securityContext:
             capabilities:
               add: ["NET_ADMIN"]
@@ -49,9 +58,9 @@ spec:
               value: "ZLiSI0SkdK5O0/fhweOpZ2c78F30gWHtsfZcVV0vlj8="
             - name: WIREGUARD_ADDRESSES
               value: "10.2.0.2/32"
-            - name: VPN_ENDPOINT_IP
+            - name: WIREGUARD_ENDPOINT_IP
               value: "95.173.217.219"
-            - name: VPN_ENDPOINT_PORT
+            - name: WIREGUARD_ENDPOINT_PORT
               value: "51820"
             # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
             - name: FIREWALL_OUTBOUND_SUBNETS
@@ -60,10 +69,10 @@ spec:
             - containerPort: 8888  # gluetun HTTP proxy (unused but required)
           resources:
             requests:
-              memory: 64Mi
+              memory: 128Mi
               cpu: 50m
             limits:
-              memory: 128Mi
+              memory: 512Mi
               cpu: 200m
 
         # qBittorrent — shares gluetun's network namespace, all traffic through VPN