diff --git a/servers/legion/k8s/media/README.md b/servers/legion/k8s/media/README.md
new file mode 100644
index 0000000..749dbd6
--- /dev/null
+++ b/servers/legion/k8s/media/README.md
@@ -0,0 +1,197 @@
+# Nook Media Stack — Operations Guide
+
+## What's Running
+
+| Service | Purpose | Internal URL | Public URL |
+|---------|---------|-------------|------------|
+| **Plex** | Streams media to family | `plex.media.svc:32400` | https://plex.nook.family |
+| **Overseerr** | Family request portal | `overseerr.media.svc:5055` | https://watch.nook.family |
+| **Radarr** | Movie automation | `radarr.media.svc:7878` | port-forward only |
+| **Sonarr** | TV/anime automation | `sonarr.media.svc:8989` | port-forward only |
+| **Prowlarr** | Indexer aggregator | `prowlarr.media.svc:9696` | port-forward only |
+| **qBittorrent** | Torrent client (via ProtonVPN) | `qbittorrent.media.svc:8080` | port-forward only |
+| **Bazarr** | Subtitle downloader | `bazarr.media.svc:6767` | port-forward only |
+| **FlareSolverr** | Cloudflare bypass proxy | `flaresolverr.media.svc:8191` | internal only |
+
+## Credentials
+
+All admin passwords: `jfqb56as@@Fox`
+
+| Service | Username | Notes |
+|---------|----------|-------|
+| qBittorrent | `admin` | Web UI admin |
+| Radarr | API key only | See below |
+| Sonarr | API key only | See below |
+| Prowlarr | API key only | See below |
+
+**API Keys** (stored in pod configs, retrieve with commands below):
+```bash
+# Radarr
+KUBECONFIG=~/.kube/legion-config kubectl exec -n media deployment/radarr -- \
+  cat /config/config.xml | grep ApiKey
+
+# Sonarr
+KUBECONFIG=~/.kube/legion-config kubectl exec -n media deployment/sonarr -- \
+  cat /config/config.xml | grep ApiKey
+
+# Prowlarr
+KUBECONFIG=~/.kube/legion-config kubectl exec -n media deployment/prowlarr -- \
+  cat /config/config.xml | grep ApiKey
+```
+
+## Accessing Admin UIs
+
+None of the backend services are exposed publicly. Use `kubectl port-forward`:
+
+```bash
+export KUBECONFIG=~/.kube/legion-config
+
+# Radarr
+kubectl port-forward -n media svc/radarr 7878:7878
+# → http://localhost:7878
+
+# Sonarr
+kubectl port-forward -n media svc/sonarr 8989:8989
+# → http://localhost:8989
+
+# Prowlarr
+kubectl port-forward -n media svc/prowlarr 9696:9696
+# → http://localhost:9696
+
+# qBittorrent
+kubectl port-forward -n media svc/qbittorrent 8080:8080
+# → http://localhost:8080
+
+# Bazarr
+kubectl port-forward -n media svc/bazarr 6767:6767
+# → http://localhost:6767
+```
+
+## Storage Layout
+
+All media lives at `/media` on Legion:
+
+```
+/media/
+├── movies/              ← Radarr deposits here → Plex "Movies" library
+├── tv/
+│   ├── shows/           ← Sonarr (TV) → Plex "TV Shows" library
+│   └── anime/           ← Sonarr (anime) → Plex "Anime" library
+└── downloads/
+    ├── complete/        ← qBittorrent finished downloads (Radarr/Sonarr pick up from here)
+    └── incomplete/      ← qBittorrent in-progress
+```
+
+## Family Accounts
+
+### Overseerr (watch.nook.family)
+
+| Name | Email | Role | Request Limits |
+|------|-------|------|----------------|
+| Will | andersonwilliam85@gmail.com | Admin | Unlimited |
+| Fox | andersonfox07@gmail.com | User | Auto-approved, unlimited |
+| Ben | andersonbenjamin2011@gmail.com | User | 5 movies/week, 3 shows/week, needs approval |
+| Chloe | celizabeth0423@gmail.com | User | 3 movies/week, 2 shows/week, needs approval |
+
+All family members sign in via **Google OAuth** (Cloudflare Access intercepts before the login page).
+
+### Plex (plex.nook.family)
+
+Set up Plex Home managed users for the kids with content rating limits:
+- Go to plex.tv → Settings → Managed Users
+- Create profiles for Ben and Chloe with rating caps (PG-13 for Ben, PG for Chloe)
+- Enable PIN on your profile
+
+## How Content Gets Added
+
+### Automatic (new releases)
+Radarr monitors for new theatrical releases. To add a movie to the watchlist:
+```
+Radarr UI → Add Movie → search → set profile to HD-720p → Add
+```
+
+### On Demand (family requests)
+1. Family member opens https://watch.nook.family
+2. Searches for movie/show → clicks Request
+3. Ben and Chloe's requests land in your Overseerr approval queue
+4. Fox's requests auto-approve
+5. Download starts within minutes of approval
+
+### Checking Download Status
+```bash
+# See active torrents
+kubectl port-forward -n media svc/qbittorrent 8080:8080
+# → http://localhost:8080
+
+# Check what Radarr is waiting on
+kubectl port-forward -n media svc/radarr 7878:7878
+# → http://localhost:7878/activity/queue
+```
+
+## Indexers (Prowlarr)
+
+| Indexer | Type | Good For |
+|---------|------|----------|
+| YTS | Movies | All movies, excellent quality |
+| Nyaa.si | Anime | All anime, essential |
+| FlareSolverr | Proxy | Bypasses Cloudflare on other indexers |
+
+To add more indexers: Prowlarr UI → Indexers → Add
+
+## VPN
+
+All torrent traffic routes through **ProtonVPN WireGuard** (US-TX#253) via the gluetun sidecar in the qBittorrent pod. The VPN connection is automatic — if gluetun loses the tunnel, qBittorrent loses internet access entirely (kill switch by design).
+
+To check VPN status:
+```bash
+KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/qbittorrent -c gluetun | tail -20
+```
+
+To rotate to a different ProtonVPN server:
+1. Download a new WireGuard config from account.proton.me
+2. `vault kv patch secret/protonvpn private_key=<new_key> endpoint=<new_endpoint> peer_public_key=<new_peer_key>`
+3. `kubectl annotate externalsecret media-secrets -n media force-sync=$(date +%s) --overwrite`
+4. `kubectl rollout restart deployment/qbittorrent -n media`
+
+## Subtitles (Bazarr)
+
+Bazarr automatically downloads subtitles for everything in your library.
+- Configure subtitle providers: Bazarr UI → Settings → Providers → add OpenSubtitles.com (free account)
+- Languages: English is default. Add others as needed.
+
+## Maintenance
+
+### Restart a service
+```bash
+KUBECONFIG=~/.kube/legion-config kubectl rollout restart deployment/<name> -n media
+# Names: plex, radarr, sonarr, prowlarr, qbittorrent, bazarr, overseerr, flaresolverr
+```
+
+### Check all pod health
+```bash
+KUBECONFIG=~/.kube/legion-config kubectl get pods -n media
+```
+
+### View logs
+```bash
+KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/radarr --tail=50
+KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/qbittorrent -c gluetun --tail=50
+KUBECONFIG=~/.kube/legion-config kubectl logs -n media deployment/qbittorrent -c qbittorrent --tail=50
+```
+
+### Update a service (pull latest image)
+```bash
+KUBECONFIG=~/.kube/legion-config kubectl rollout restart deployment/<name> -n media
+```
+All services use `:latest` tags — a restart pulls the newest image.
+
+### Add disk space later
+When you get a new server/drive, update the PersistentVolume in `k8s/media/pvc.yaml`:
+- Change `hostPath.path` to the new mount point
+- Increase `storage` capacity
+- Push to git → Argo CD syncs
+
+## Upgrading to Seerr (when ready)
+Overseerr is being superseded by Seerr. To migrate:
+1. Edit `k8s/media/overseerr.yaml`, change image to `seerr/seerr:latest`
+2. Push to git — Argo CD will redeploy with config intact (same `/app/config` PVC)
diff --git a/servers/legion/k8s/media/overseerr.yaml b/servers/legion/k8s/media/overseerr.yaml
index 963a565..a37e4b0 100644
--- a/servers/legion/k8s/media/overseerr.yaml
+++ b/servers/legion/k8s/media/overseerr.yaml
@@ -1,11 +1,6 @@
 # Overseerr — family request portal (watch.nook.family)
+# NOTE: Overseerr is being superseded by Seerr — migrate when ready
 # Family members browse and request content here
-# After deploy, complete setup wizard at watch.nook.family:
-#   1. Sign in with Plex account
-#   2. Connect to Plex server
-#   3. Add Radarr (http://radarr:7878) and Sonarr (http://sonarr:8989)
-#   4. Create managed user accounts for each family member
-#   5. Set request permissions per user (kids require approval)
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -27,7 +22,7 @@ spec:
     spec:
       containers:
         - name: overseerr
-          image: sctx/overseerr:latest
+          image: seerr/seerr:latest
           env:
             - name: TZ
               value: "America/Chicago"