diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml
index b20068b..09041d2 100644
--- a/servers/legion/k8s/media/fornax-workers.yaml
+++ b/servers/legion/k8s/media/fornax-workers.yaml
@@ -60,6 +60,8 @@ spec:
               value: "51820"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
+            - name: FIREWALL_INPUT_PORTS
+              value: "5351"
           ports:
             - containerPort: 8888
           resources:
@@ -214,6 +216,8 @@ spec:
               value: "51820"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
+            - name: FIREWALL_INPUT_PORTS
+              value: "5351"
           ports:
             - containerPort: 8888
           resources:
diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
index 8fc266d..70d5f9c 100644
--- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml
+++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
@@ -56,6 +56,8 @@ spec:
             # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
+            - name: FIREWALL_INPUT_PORTS
+              value: "5351"
           ports:
             - containerPort: 8888  # gluetun HTTP proxy (unused but required)
           resources: