diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index 7a97028..60e5ccd 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -110,6 +110,14 @@ resource "cloudflare_tunnel_config" "legion" {
       }
     }
 
+    ingress_rule {
+      hostname = "prowlarr.voidstash.xyz"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # Catch-all — must be last
     ingress_rule {
       service = "http_status:404"
diff --git a/servers/legion/voidstash.tf b/servers/legion/voidstash.tf
index 008f5fe..a9e4370 100644
--- a/servers/legion/voidstash.tf
+++ b/servers/legion/voidstash.tf
@@ -1,4 +1,4 @@
-# voidstash.xyz — private media stack (Stash + Whisparr)
+# voidstash.xyz — private media stack (Stash + Whisparr + Prowlarr)
 # Zone created via API: ba74d72edbea8023ff4ed6cb27487154
 # Nameservers delegated to Cloudflare from Porkbun
 
@@ -22,3 +22,11 @@ resource "cloudflare_record" "whisparr" {
   content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
   proxied = true
 }
+
+resource "cloudflare_record" "prowlarr_voidstash" {
+  zone_id = data.cloudflare_zone.voidstash.id
+  name    = "prowlarr"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+}