diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
index 5e87c93..8c41b2d 100644
--- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml
+++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
@@ -34,8 +34,9 @@ spec:
             capabilities:
               add: ["NET_ADMIN"]
           env:
+            # Use custom provider pinned to US-TX#457 — this specific server+key combo is confirmed working
             - name: VPN_SERVICE_PROVIDER
-              value: "protonvpn"
+              value: "custom"
             - name: VPN_TYPE
               value: "wireguard"
             - name: WIREGUARD_PRIVATE_KEY
@@ -43,22 +44,18 @@ spec:
                 secretKeyRef:
                   name: media-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            # Pick a US P2P server — P2P servers support port forwarding
-            - name: SERVER_COUNTRIES
-              value: "United States"
-            - name: SERVER_FEATURES
-              value: "p2p"
-            # Port forwarding via NAT-PMP — lets peers connect inbound, fixes slow/stalled downloads
-            - name: VPN_PORT_FORWARDING
-              value: "on"
-            # When gluetun gets a forwarded port, tell qBittorrent to listen on it
-            - name: VPN_PORT_FORWARDING_UP_COMMAND
-              value: "/bin/sh -c 'curl -s -c /tmp/pf.jar -X POST http://localhost:8080/api/v2/auth/login -d username=admin&password=adminadmin >/dev/null && curl -s -b /tmp/pf.jar -X POST http://localhost:8080/api/v2/app/setPreferences -d \"json={\\\"listen_port\\\":{{FORWARDED_PORT}}}\"'"
+            # US-TX#457 server — generated from ProtonVPN portal with NAT-PMP=on
+            - name: WIREGUARD_PUBLIC_KEY
+              value: "ZLiSI0SkdK5O0/fhweOpZ2c78F30gWHtsfZcVV0vlj8="
+            - name: WIREGUARD_ADDRESSES
+              value: "10.2.0.2/32"
+            - name: VPN_ENDPOINT_IP
+              value: "95.173.217.219"
+            - name: VPN_ENDPOINT_PORT
+              value: "51820"
             # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
-            - name: UPDATER_PERIOD
-              value: "24h"
           ports:
             - containerPort: 8888  # gluetun HTTP proxy (unused but required)
           resources: