diff --git a/servers/legion/k8s/media/gluetun-qbittorrent.yaml b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
index a0548d6..8fc266d 100644
--- a/servers/legion/k8s/media/gluetun-qbittorrent.yaml
+++ b/servers/legion/k8s/media/gluetun-qbittorrent.yaml
@@ -34,7 +34,7 @@ spec:
             capabilities:
               add: ["NET_ADMIN"]
           env:
-            # Use custom provider pinned to US-TX#457 — this specific server+key combo is confirmed working
+            # Use custom provider pinned to US-IL#267 — NAT-PMP port forwarding enabled
             - name: VPN_SERVICE_PROVIDER
               value: "custom"
             - name: VPN_TYPE
@@ -44,13 +44,13 @@ spec:
                 secretKeyRef:
                   name: media-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            # US-TX#457 server — generated from ProtonVPN portal with NAT-PMP=on
+            # US-IL#267 server — generated from ProtonVPN portal with NAT-PMP=on
             - name: WIREGUARD_PUBLIC_KEY
-              value: "ZLiSI0SkdK5O0/fhweOpZ2c78F30gWHtsfZcVV0vlj8="
+              value: "qT0lxDVbWEIyrL2A40FfCXRlUALvnryRz2aQdD6gUDs="
             - name: WIREGUARD_ADDRESSES
               value: "10.2.0.2/32"
             - name: WIREGUARD_ENDPOINT_IP
-              value: "95.173.217.219"
+              value: "89.187.180.40"
             - name: WIREGUARD_ENDPOINT_PORT
               value: "51820"
             # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)