diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index fd69c0e..edd8884 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -237,6 +237,33 @@ jelly.franksdank.cloud {
 	reverse_proxy 192.168.0.235:8096
 }
 
+
+# --- *arr Stack (exempt by construction: own auth) ---
+
+prowlarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:9696
+}
+
+radarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:7878
+}
+
+sonarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:8989
+}
+
+lidarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:8686
+}
+
+readarr.franksdank.cloud {
+	reverse_proxy 192.168.0.235:8787
+}
+
+qbittorrent.franksdank.cloud {
+	reverse_proxy 192.168.0.235:8080
+}
+
 # --- Internal listener: auth decision layer ---------------------------------
 # Anubis dials http://caddy:8016 after verifying a client (TARGET in
 # dankclaw/anubis/quadlet/anubis.container). Host headers survive the hop.
@@ -324,6 +351,36 @@ http://:8017 {
 	handle @files {
 		reverse_proxy 192.168.0.235:3923
 	}
+
+	@prowlarr host prowlarr.franksdank.cloud
+	handle @prowlarr {
+		reverse_proxy 192.168.0.235:9696
+	}
+
+	@radarr host radarr.franksdank.cloud
+	handle @radarr {
+		reverse_proxy 192.168.0.235:7878
+	}
+
+	@sonarr host sonarr.franksdank.cloud
+	handle @sonarr {
+		reverse_proxy 192.168.0.235:8989
+	}
+
+	@lidarr host lidarr.franksdank.cloud
+	handle @lidarr {
+		reverse_proxy 192.168.0.235:8686
+	}
+
+	@readarr host readarr.franksdank.cloud
+	handle @readarr {
+		reverse_proxy 192.168.0.235:8787
+	}
+
+	@qbittorrent host qbittorrent.franksdank.cloud
+	handle @qbittorrent {
+		reverse_proxy 192.168.0.235:8080
+	}
 }
 
 # --- Optional: Jackett ---