diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml
index e097248..e8e888f 100644
--- a/servers/legion/k8s/media/fornax-workers.yaml
+++ b/servers/legion/k8s/media/fornax-workers.yaml
@@ -34,6 +34,26 @@ spec:
           command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && ip route flush table 51820 2>/dev/null || true && ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true"]
           securityContext:
             privileged: true
+        - name: qbt-config-patch
+          image: busybox:latest
+          command:
+            - sh
+            - -c
+            - |
+              CONF=/config/qBittorrent/qBittorrent.conf
+              mkdir -p /config/qBittorrent
+              if [ -f "$CONF" ]; then
+                if grep -q "LocalhostAuthEnabled" "$CONF"; then
+                  sed -i 's/LocalhostAuthEnabled=.*/LocalhostAuthEnabled=false/' "$CONF"
+                else
+                  sed -i '/^\[Preferences\]/a WebUI\\LocalhostAuthEnabled=false' "$CONF" || \
+                  printf '\n[Preferences]\nWebUI\\LocalhostAuthEnabled=false\n' >> "$CONF"
+                fi
+              fi
+              echo "Config patched: $(grep LocalhostAuth $CONF 2>/dev/null || echo 'will be set on first run')"
+          volumeMounts:
+            - name: config
+              mountPath: /config
       containers:
         - name: gluetun
           image: ghcr.io/qdm12/gluetun:latest
@@ -188,6 +208,26 @@ spec:
           command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && ip route flush table 51820 2>/dev/null || true && ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true"]
           securityContext:
             privileged: true
+        - name: qbt-config-patch
+          image: busybox:latest
+          command:
+            - sh
+            - -c
+            - |
+              CONF=/config/qBittorrent/qBittorrent.conf
+              mkdir -p /config/qBittorrent
+              if [ -f "$CONF" ]; then
+                if grep -q "LocalhostAuthEnabled" "$CONF"; then
+                  sed -i 's/LocalhostAuthEnabled=.*/LocalhostAuthEnabled=false/' "$CONF"
+                else
+                  sed -i '/^\[Preferences\]/a WebUI\\LocalhostAuthEnabled=false' "$CONF" || \
+                  printf '\n[Preferences]\nWebUI\\LocalhostAuthEnabled=false\n' >> "$CONF"
+                fi
+              fi
+              echo "Config patched: $(grep LocalhostAuth $CONF 2>/dev/null || echo 'will be set on first run')"
+          volumeMounts:
+            - name: config
+              mountPath: /config
       containers:
         - name: gluetun
           image: ghcr.io/qdm12/gluetun:latest
diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
index 773ec23..b11ac8a 100644
--- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml
+++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
@@ -27,6 +27,27 @@ spec:
           command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && ip route flush table 51820 2>/dev/null || true && ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true"]
           securityContext:
             privileged: true
+        # Patch qBittorrent config before it starts so localhost auth is disabled from boot
+        - name: qbt-config-patch
+          image: busybox:latest
+          command:
+            - sh
+            - -c
+            - |
+              CONF=/config/qBittorrent/qBittorrent.conf
+              mkdir -p /config/qBittorrent
+              if [ -f "$CONF" ]; then
+                if grep -q "LocalhostAuthEnabled" "$CONF"; then
+                  sed -i 's/LocalhostAuthEnabled=.*/LocalhostAuthEnabled=false/' "$CONF"
+                else
+                  sed -i '/^\[Preferences\]/a WebUI\\LocalhostAuthEnabled=false' "$CONF" || \
+                  printf '\n[Preferences]\nWebUI\\LocalhostAuthEnabled=false\n' >> "$CONF"
+                fi
+              fi
+              echo "Config patched: $(grep LocalhostAuth $CONF 2>/dev/null || echo 'will be set on first run')"
+          volumeMounts:
+            - name: config
+              mountPath: /config
       containers:
         - name: gluetun
           image: ghcr.io/qdm12/gluetun:latest