diff --git a/dankserver/jellyfin/quadlet/jellyfin.container b/dankserver/jellyfin/quadlet/jellyfin.container
index b0bb6da..1a183aa 100644
--- a/dankserver/jellyfin/quadlet/jellyfin.container
+++ b/dankserver/jellyfin/quadlet/jellyfin.container
@@ -43,7 +43,7 @@ Volume=/home/dank/Containers/jellyfin/config:/config
 Volume=/home/dank/Containers/jellyfin/cache:/cache
 Volume=/mnt/entropy/Movies:/data/movies:ro
 Volume=/mnt/entropy/TVShows:/data/shows:ro
-Device=/dev/dri
+AddDevice=/dev/dri
 GroupAdd=keep-groups
 HealthCmd=curl -f http://localhost:8096/health
 HealthInterval=30s
diff --git a/tests/dankserver_quadlet.bats b/tests/dankserver_quadlet.bats
index 0ca62f8..ac2afdb 100755
--- a/tests/dankserver_quadlet.bats
+++ b/tests/dankserver_quadlet.bats
@@ -43,3 +43,16 @@ load helpers
     grep -q '^Network=dankserver_appnet:alias=redis$' \
         "$REPO_ROOT/dankserver/romm/quadlet/romm-redis.container" || return 1
 }
+
+@test "no unit uses the unsupported Device= key (v1 generator needs AddDevice=)" {
+    # A rejected file kills its own unit silently: the deploy would then die
+    # with "Unit jellyfin.service not found" only on the target. Device= was
+    # the first offender (jellyfin GPU passthrough); Command= is guarded
+    # above. Keep this list current with every generator finding.
+    for unit in dankserver/romm/quadlet/romm dankserver/romm/quadlet/romm-mariadb \
+                dankserver/romm/quadlet/romm-redis dankserver/jellyfin/quadlet/jellyfin \
+                dankserver/calibre-web/quadlet/calibre-web dankserver/copyparty/quadlet/copyparty; do
+        ! grep -q '^Device=' "$REPO_ROOT/$unit.container" || return 1
+    done
+    grep -q '^AddDevice=/dev/dri$' "$REPO_ROOT/dankserver/jellyfin/quadlet/jellyfin.container" || return 1
+}