diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
index a0c0e59..1a75d68 100644
--- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml
+++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
@@ -23,7 +23,7 @@ spec:
         # Ensure /dev/net/tun exists on the node
         - name: tun-setup
           image: busybox:latest
-          command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun"]
+          command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true"]
           securityContext:
             privileged: true
       containers:
diff --git a/servers/legion/k8s/media/ingress.yaml b/servers/legion/k8s/media/ingress.yaml
index aea9ec6..9e6fe9a 100644
--- a/servers/legion/k8s/media/ingress.yaml
+++ b/servers/legion/k8s/media/ingress.yaml
@@ -156,13 +156,13 @@ spec:
                 port:
                   number: 5055
 ---
-# plex.nook.family → Plex
+# plex.nook.family → Jellyfin (replaced Plex)
 # NOTE: Also add in Cloudflare Zero Trust:
 #   Hostname: plex.nook.family | Service: http://traefik.kube-system:80
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: plex
+  name: jellyfin
   namespace: media
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -181,6 +181,6 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: plex
+                name: jellyfin
                 port:
-                  number: 32400
+                  number: 8096
diff --git a/servers/legion/k8s/media/plex.yaml b/servers/legion/k8s/media/plex.yaml
index 8952106..504e749 100644
--- a/servers/legion/k8s/media/plex.yaml
+++ b/servers/legion/k8s/media/plex.yaml
@@ -1,41 +1,36 @@
-# Plex Media Server
-# BEFORE FIRST DEPLOY: add claim token to Vault
-#   1. Go to https://www.plex.tv/claim (token expires in 4 minutes)
-#   2. vault kv put secret/plex claim_token=<token>
-#   3. Then push and let Argo CD deploy
-# After first startup the token is stored in config and can be left as-is
+# Jellyfin Media Server (replaced Plex — no account or subscription required)
 #
 # Post-deploy setup:
-#   1. Access via plex.nook.family or port-forward :32400
-#   2. Add libraries:
+#   1. Access via plex.nook.family or jellyfin.nook.family
+#   2. Run the setup wizard: create admin account, add libraries:
 #      - Movies → /media/movies
 #      - TV Shows → /media/tv/shows
-#      - Anime (TV Shows) → /media/tv/anime
-#   3. Settings > Manage > Users & Sharing → create Plex Home managed users
-#   4. Set content rating limits per child profile (G/PG/PG-13)
-#   5. Enable PIN on adult profiles
+#      - Anime → /media/tv/anime
+#   3. Dashboard → Users → Add User for each family member
+#   4. Per user → Parental Controls → set max rating (PG-13 for Ben, PG for Chloe)
+#   5. Per user → set PIN if desired
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: plex
+  name: jellyfin
   namespace: media
   labels:
-    app: plex
+    app: jellyfin
 spec:
   replicas: 1
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app: plex
+      app: jellyfin
   template:
     metadata:
       labels:
-        app: plex
+        app: jellyfin
     spec:
       containers:
-        - name: plex
-          image: lscr.io/linuxserver/plex:latest
+        - name: jellyfin
+          image: lscr.io/linuxserver/jellyfin:latest
           env:
             - name: PUID
               value: "1000"
@@ -43,19 +38,9 @@ spec:
               value: "1000"
             - name: TZ
               value: "America/Chicago"
-            - name: VERSION
-              value: "docker"
-            - name: PLEX_CLAIM
-              valueFrom:
-                secretKeyRef:
-                  name: media-secrets
-                  key: PLEX_CLAIM
-                  optional: true  # safe after first boot
-            - name: ADVERTISE_IP
-              value: "https://plex.nook.family:443"
           ports:
-            - containerPort: 32400
-              name: plex
+            - containerPort: 8096
+              name: http
           volumeMounts:
             - name: config
               mountPath: /config
@@ -63,27 +48,27 @@ spec:
               mountPath: /media
           resources:
             requests:
-              memory: 1Gi
+              memory: 512Mi
               cpu: 500m
             limits:
               memory: 4Gi
               cpu: 2000m
           livenessProbe:
             httpGet:
-              path: /identity
-              port: 32400
+              path: /health
+              port: 8096
             initialDelaySeconds: 60
             periodSeconds: 30
           readinessProbe:
             httpGet:
-              path: /identity
-              port: 32400
+              path: /health
+              port: 8096
             initialDelaySeconds: 30
             periodSeconds: 10
       volumes:
         - name: config
           persistentVolumeClaim:
-            claimName: plex-config
+            claimName: jellyfin-config
         - name: media
           persistentVolumeClaim:
             claimName: media-data
@@ -91,13 +76,13 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: plex
+  name: jellyfin
   namespace: media
 spec:
   selector:
-    app: plex
+    app: jellyfin
   ports:
-    - name: plex
-      port: 32400
-      targetPort: 32400
+    - name: http
+      port: 8096
+      targetPort: 8096
   type: ClusterIP
diff --git a/servers/legion/k8s/media/pvc.yaml b/servers/legion/k8s/media/pvc.yaml
index b32c17d..d6759ac 100644
--- a/servers/legion/k8s/media/pvc.yaml
+++ b/servers/legion/k8s/media/pvc.yaml
@@ -35,7 +35,7 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: plex-config
+  name: jellyfin-config
   namespace: media
 spec:
   storageClassName: local-path