diff --git a/hosts/layne/default.nix b/hosts/layne/default.nix
index 0f8026f..32493a9 100644
--- a/hosts/layne/default.nix
+++ b/hosts/layne/default.nix
@@ -5,6 +5,7 @@ _: {
     ./services
     ./network.nix
     ./security.nix
+    ./users.nix
   ];
 
   nodeconfig = {
diff --git a/hosts/layne/services/apps/default.nix b/hosts/layne/services/apps/default.nix
index 27408f9..d405c50 100644
--- a/hosts/layne/services/apps/default.nix
+++ b/hosts/layne/services/apps/default.nix
@@ -3,6 +3,8 @@ _: {
     ./jellyfin.nix
     ./transmission.nix
     ./radarr.nix
+    ./sonarr.nix
+    ./jackett.nix
     ../../../shared/prometheus-exporters.nix
     ../../../shared/promtail.nix
   ];
diff --git a/hosts/layne/services/apps/jackett.nix b/hosts/layne/services/apps/jackett.nix
new file mode 100644
index 0000000..21dedda
--- /dev/null
+++ b/hosts/layne/services/apps/jackett.nix
@@ -0,0 +1,17 @@
+_: {
+  services = {
+    caddy.virtualHosts."jackett.labs.adtya.xyz" = {
+      extraConfig = ''
+        reverse_proxy 127.0.0.1:9117
+      '';
+    };
+    jackett = {
+      enable = true;
+      user = "mediaserver";
+      group = "mediaserver";
+      dataDir = "/mnt/data/jackett";
+      port = 9117;
+    };
+  };
+  systemd.services.radarr.unitConfig.RequiresMountsFor = [ "/mnt/data" ];
+}
diff --git a/hosts/layne/services/apps/jellyfin.nix b/hosts/layne/services/apps/jellyfin.nix
index 6eae80b..f4d55c2 100644
--- a/hosts/layne/services/apps/jellyfin.nix
+++ b/hosts/layne/services/apps/jellyfin.nix
@@ -45,6 +45,8 @@ in
     ];
     jellyfin = {
       enable = true;
+      user = "mediaserver";
+      group = "mediaserver";
       dataDir = "/mnt/data/Jellyfin";
       openFirewall = true;
     };
diff --git a/hosts/layne/services/apps/radarr.nix b/hosts/layne/services/apps/radarr.nix
index 1956f8a..8c5ddd9 100644
--- a/hosts/layne/services/apps/radarr.nix
+++ b/hosts/layne/services/apps/radarr.nix
@@ -8,6 +8,8 @@ _: {
     radarr = {
       enable = true;
       dataDir = "/mnt/data/radarr";
+      user = "mediaserver";
+      group = "mediaserver";
     };
   };
   systemd.services.radarr.unitConfig.RequiresMountsFor = [ "/mnt/data" ];
diff --git a/hosts/layne/services/apps/sonarr.nix b/hosts/layne/services/apps/sonarr.nix
new file mode 100644
index 0000000..af57505
--- /dev/null
+++ b/hosts/layne/services/apps/sonarr.nix
@@ -0,0 +1,16 @@
+_: {
+  services = {
+    caddy.virtualHosts."sonarr.labs.adtya.xyz" = {
+      extraConfig = ''
+        reverse_proxy 127.0.0.1:8989
+      '';
+    };
+    sonarr = {
+      enable = true;
+      dataDir = "/mnt/data/sonarr";
+      user = "mediaserver";
+      group = "mediaserver";
+    };
+  };
+  systemd.services.radarr.unitConfig.RequiresMountsFor = [ "/mnt/data" ];
+}
diff --git a/hosts/layne/services/apps/transmission.nix b/hosts/layne/services/apps/transmission.nix
index 611a93a..73016c2 100644
--- a/hosts/layne/services/apps/transmission.nix
+++ b/hosts/layne/services/apps/transmission.nix
@@ -13,6 +13,8 @@ in
       };
     };
     transmission = {
+      user = "mediaserver";
+      group = "mediaserver";
       enable = true;
       package = pkgs.transmission_4;
       downloadDirPermissions = "775";
diff --git a/hosts/layne/users.nix b/hosts/layne/users.nix
new file mode 100644
index 0000000..c607ef5
--- /dev/null
+++ b/hosts/layne/users.nix
@@ -0,0 +1,18 @@
+_: {
+  users = {
+    users = {
+      mediaserver = {
+        group = "mediaserver";
+        uid = 899;
+        isSystemUser = true;
+        description = "Media Server user";
+      };
+    };
+
+    groups = {
+      mediaserver = {
+        gid = 899;
+      };
+    };
+  };
+}
diff --git a/hosts/rico0/services/apps/blocky.nix b/hosts/rico0/services/apps/blocky.nix
index 12aeef2..43d82cd 100644
--- a/hosts/rico0/services/apps/blocky.nix
+++ b/hosts/rico0/services/apps/blocky.nix
@@ -79,6 +79,8 @@ in
             "transmission.labs.adtya.xyz" = "10.10.10.14,fd7c:585c:c4ae::14";
             "jellyfin.labs.adtya.xyz" = "10.10.10.14,fd7c:585c:c4ae::14";
             "radarr.labs.adtya.xyz" = "10.10.10.14,fd7c:585c:c4ae::14";
+            "sonarr.labs.adtya.xyz" = "10.10.10.14,fd7c:585c:c4ae::14";
+            "jackett.labs.adtya.xyz" = "10.10.10.14,fd7c:585c:c4ae::14";
             "jellyfin.local.adtya.xyz" = "192.168.1.14";
           };
         };