diff --git a/servers/legion/k8s/media/external-secrets.yaml b/servers/legion/k8s/media/external-secrets.yaml
index be5be5b..5c42a5a 100644
--- a/servers/legion/k8s/media/external-secrets.yaml
+++ b/servers/legion/k8s/media/external-secrets.yaml
@@ -1,4 +1,4 @@
-# media-secrets — ProtonVPN WireGuard credentials
+# media-secrets — ProtonVPN WireGuard credentials + service API keys
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
@@ -17,3 +17,19 @@ spec:
       remoteRef:
         key: secret/data/protonvpn
         property: private_key
+    - secretKey: QBITTORRENT_USERNAME
+      remoteRef:
+        key: secret/data/qbittorrent
+        property: username
+    - secretKey: QBITTORRENT_PASSWORD
+      remoteRef:
+        key: secret/data/qbittorrent
+        property: password
+    - secretKey: JELLYFIN_API_KEY
+      remoteRef:
+        key: secret/data/jellyfin
+        property: api_key
+    - secretKey: SEERR_API_KEY
+      remoteRef:
+        key: secret/data/seerr
+        property: api_key
diff --git a/servers/legion/k8s/media/plex.yaml b/servers/legion/k8s/media/plex.yaml
index 504e749..b939b82 100644
--- a/servers/legion/k8s/media/plex.yaml
+++ b/servers/legion/k8s/media/plex.yaml
@@ -28,6 +28,29 @@ spec:
       labels:
         app: jellyfin
     spec:
+      initContainers:
+        # Ensure all media subdirectories exist on the hostPath volume
+        - name: media-dirs
+          image: busybox:latest
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p \
+                /media/movies \
+                /media/tv/shows \
+                /media/tv/anime \
+                /media/documentaries \
+                /media/standup \
+                /media/concerts \
+                /media/kids \
+                /media/music \
+                /media/downloads/complete \
+                /media/downloads/incomplete
+              chown -R 1000:1000 /media
+          volumeMounts:
+            - name: media
+              mountPath: /media
       containers:
         - name: jellyfin
           image: lscr.io/linuxserver/jellyfin:latest
diff --git a/servers/legion/k8s/media/pvc.yaml b/servers/legion/k8s/media/pvc.yaml
index d6759ac..2becd35 100644
--- a/servers/legion/k8s/media/pvc.yaml
+++ b/servers/legion/k8s/media/pvc.yaml
@@ -1,4 +1,14 @@
 # Shared media PV — hostPath /media on Legion (single-node cluster)
+# Folder structure:
+#   /media/movies          — feature films
+#   /media/tv/shows        — TV series
+#   /media/tv/anime        — anime series
+#   /media/documentaries   — documentaries
+#   /media/standup         — stand-up comedy specials
+#   /media/concerts        — concerts & music videos
+#   /media/kids            — kids & family content
+#   /media/music           — audio music library
+#   /media/downloads       — qBittorrent working dir (complete/incomplete)
 apiVersion: v1
 kind: PersistentVolume
 metadata: