diff --git a/keel/keel.yaml b/keel/keel.yaml
new file mode 100644
index 0000000..0dba801
--- /dev/null
+++ b/keel/keel.yaml
@@ -0,0 +1,72 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: keel
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: keel
+  namespace: keel
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: keel
+rules:
+  - apiGroups: ["", "apps", "batch", "extensions"]
+    resources:
+      - namespaces
+      - deployments
+      - daemonsets
+      - statefulsets
+      - cronjobs
+      - pods
+      - replicationcontrollers
+    verbs: ["get", "list", "watch", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: keel
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: keel
+subjects:
+  - kind: ServiceAccount
+    name: keel
+    namespace: keel
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keel
+  namespace: keel
+  labels:
+    app: keel
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keel
+  template:
+    metadata:
+      labels:
+        app: keel
+    spec:
+      serviceAccountName: keel
+      containers:
+        - name: keel
+          image: keelhq/keel:latest
+          imagePullPolicy: Always
+          env:
+            - name: POLL
+              value: "true"
+            - name: SCHEDULER_FREQUENCY
+              value: "1h"
+            - name: AUTO_UPDATE_EVERYTHING
+              value: "false"
+          ports:
+            - containerPort: 9300
+              name: keel
diff --git a/services/readmeabook/readmeabook-cron-jobs.yaml b/retired-services/readmeabook/readmeabook-cron-jobs.yaml
similarity index 100%
rename from services/readmeabook/readmeabook-cron-jobs.yaml
rename to retired-services/readmeabook/readmeabook-cron-jobs.yaml
diff --git a/services/readmeabook/readmeabook-deployment.yaml b/retired-services/readmeabook/readmeabook-deployment.yaml
similarity index 100%
rename from services/readmeabook/readmeabook-deployment.yaml
rename to retired-services/readmeabook/readmeabook-deployment.yaml
diff --git a/services/readmeabook/readmeabook-ingress.yaml b/retired-services/readmeabook/readmeabook-ingress.yaml
similarity index 100%
rename from services/readmeabook/readmeabook-ingress.yaml
rename to retired-services/readmeabook/readmeabook-ingress.yaml
diff --git a/services/readmeabook/readmeabook-pvc.yaml b/retired-services/readmeabook/readmeabook-pvc.yaml
similarity index 100%
rename from services/readmeabook/readmeabook-pvc.yaml
rename to retired-services/readmeabook/readmeabook-pvc.yaml
diff --git a/services/readmeabook/readmeabook-service.yaml b/retired-services/readmeabook/readmeabook-service.yaml
similarity index 100%
rename from services/readmeabook/readmeabook-service.yaml
rename to retired-services/readmeabook/readmeabook-service.yaml
diff --git a/services/audiobookshelf/audiobookshelf-deployment.yaml b/services/audiobookshelf/audiobookshelf-deployment.yaml
index f27d2fe..5881e23 100644
--- a/services/audiobookshelf/audiobookshelf-deployment.yaml
+++ b/services/audiobookshelf/audiobookshelf-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-abs.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: audiobookshelf
   name: audiobookshelf
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: audiobookshelf
+      app: audiobookshelf
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-abs.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: audiobookshelf
+        app: audiobookshelf
     spec:
       containers:
         - env:
diff --git a/services/audiobookshelf/audiobookshelf-service.yaml b/services/audiobookshelf/audiobookshelf-service.yaml
index 5475b77..5b6521c 100644
--- a/services/audiobookshelf/audiobookshelf-service.yaml
+++ b/services/audiobookshelf/audiobookshelf-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-abs.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: audiobookshelf
   name: audiobookshelf
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: audiobookshelf
+    app: audiobookshelf
diff --git a/services/bazarr-anime/bazarr-anime-deployment.yaml b/services/bazarr-anime/bazarr-anime-deployment.yaml
index 7f936c9..1a5518c 100644
--- a/services/bazarr-anime/bazarr-anime-deployment.yaml
+++ b/services/bazarr-anime/bazarr-anime-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: bazarr-anime
   name: bazarr-anime
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: bazarr-anime
+      app: bazarr-anime
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: bazarr-anime
+        app: bazarr-anime
     spec:
       containers:
         - env:
diff --git a/services/bazarr-anime/bazarr-anime-service.yaml b/services/bazarr-anime/bazarr-anime-service.yaml
index f82ee0e..b66ba8b 100644
--- a/services/bazarr-anime/bazarr-anime-service.yaml
+++ b/services/bazarr-anime/bazarr-anime-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: bazarr-anime
   name: bazarr-anime
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: bazarr-anime
+    app: bazarr-anime
diff --git a/services/bazarr/bazarr-deployment.yaml b/services/bazarr/bazarr-deployment.yaml
index e9b79a4..64fc7d1 100644
--- a/services/bazarr/bazarr-deployment.yaml
+++ b/services/bazarr/bazarr-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: bazarr
   name: bazarr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: bazarr
+      app: bazarr
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: bazarr
+        app: bazarr
     spec:
       containers:
         - env:
diff --git a/services/bazarr/bazarr-service.yaml b/services/bazarr/bazarr-service.yaml
index 050a544..1e3d9f3 100644
--- a/services/bazarr/bazarr-service.yaml
+++ b/services/bazarr/bazarr-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: bazarr
   name: bazarr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: bazarr
+    app: bazarr
diff --git a/services/calibre-web/app.db b/services/calibre-web/app.db
deleted file mode 100644
index 1ff8955..0000000
Binary files a/services/calibre-web/app.db and /dev/null differ
diff --git a/services/calibre-web/calibre-web-deployment.yaml b/services/calibre-web/calibre-web-deployment.yaml
index b5c248e..9d3949b 100644
--- a/services/calibre-web/calibre-web-deployment.yaml
+++ b/services/calibre-web/calibre-web-deployment.yaml
@@ -1,23 +1,22 @@
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    io.kompose.service: calibre-web
   name: calibre-web
   annotations:
-    reloader.stakater.com/auto: "true"
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: calibre-web
+      app: calibre-web
   strategy:
     type: Recreate
   template:
     metadata:
       labels:
-        io.kompose.service: calibre-web
+        app: calibre-web
     spec:
       containers:
         - name: calibre-web
diff --git a/services/calibre-web/calibre-web-service.yaml b/services/calibre-web/calibre-web-service.yaml
index 84b2306..b41a0f9 100644
--- a/services/calibre-web/calibre-web-service.yaml
+++ b/services/calibre-web/calibre-web-service.yaml
@@ -1,8 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  labels:
-    io.kompose.service: calibre-web
   name: calibre-web
 spec:
   type: ClusterIP
@@ -11,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: calibre-web
+    app: calibre-web
diff --git a/services/deluge/deluge-deployment.yaml b/services/deluge/deluge-deployment.yaml
index 79ece03..bb153b5 100644
--- a/services/deluge/deluge-deployment.yaml
+++ b/services/deluge/deluge-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: deluge
   name: deluge
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: deluge
+      app: deluge
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: deluge
+        app: deluge
     spec:
       containers:
         - env:
@@ -61,18 +57,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: deluge-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 20Mi
diff --git a/services/deluge/deluge-pvcs.yaml b/services/deluge/deluge-pvcs.yaml
new file mode 100644
index 0000000..0c6940f
--- /dev/null
+++ b/services/deluge/deluge-pvcs.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: deluge-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 20Mi
diff --git a/services/deluge/deluge-service.yaml b/services/deluge/deluge-service.yaml
index 2069bc2..600e17a 100644
--- a/services/deluge/deluge-service.yaml
+++ b/services/deluge/deluge-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: deluge
   name: deluge
 spec:
   type: ClusterIP
@@ -24,4 +19,4 @@ spec:
       port: 82
       targetPort: daemon
   selector:
-    io.kompose.service: deluge
+    app: deluge
diff --git a/services/droppedneedle/droppedneedle-deployment.yaml b/services/droppedneedle/droppedneedle-deployment.yaml
index 3f32955..a106350 100644
--- a/services/droppedneedle/droppedneedle-deployment.yaml
+++ b/services/droppedneedle/droppedneedle-deployment.yaml
@@ -1,10 +1,11 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: droppedneedle
   name: droppedneedle
-  namespace: default
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
diff --git a/services/droppedneedle/droppedneedle-external-secret.yaml b/services/droppedneedle/droppedneedle-external-secret.yaml
new file mode 100644
index 0000000..b294cb0
--- /dev/null
+++ b/services/droppedneedle/droppedneedle-external-secret.yaml
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: droppedneedle-secret
+  namespace: default
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: droppedneedle-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: SERVICE_USER
+    remoteRef:
+      key: dropped-needle
+      property: service-user
+  - secretKey: SERVICE_PASS
+    remoteRef:
+      key: dropped-needle
+      property: service-password
diff --git a/services/droppedneedle/droppedneedle-pvcs.yaml b/services/droppedneedle/droppedneedle-pvcs.yaml
new file mode 100644
index 0000000..ade72f6
--- /dev/null
+++ b/services/droppedneedle/droppedneedle-pvcs.yaml
@@ -0,0 +1,66 @@
+# Note: This service changed name from musicseerr to droppedneedle
+# PVC names are immutable, so just keeping the old names
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: musicseerr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 3Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: musicseerr-cache-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 3Gi
+---
+# For use by the transcoding service
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: droppedneedle-transcode-pv
+spec:
+  capacity:
+    storage: 3Ti
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-raid
+  local:
+    path: /mnt/raid/yarr/media/music
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - robin
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: droppedneedle-transcode-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-raid
+  resources:
+    requests:
+      storage: 3Ti
diff --git a/services/droppedneedle/droppedneedle-transcode.yaml b/services/droppedneedle/droppedneedle-transcode.yaml
index a061d7d..f6909b3 100644
--- a/services/droppedneedle/droppedneedle-transcode.yaml
+++ b/services/droppedneedle/droppedneedle-transcode.yaml
@@ -6,27 +6,34 @@ metadata:
 data:
   transcode.sh: |
     #!/bin/bash
-    WATCH_DIR="/yarr/media/music"
+    WATCH_DIR="/music"
     echo "Starting transcoder watch on $WATCH_DIR..."
     
-    # Listen for files moved into the directory (atomic renames) and direct writes
     inotifywait -m -r -e moved_to,close_write --format '%w%f' "$WATCH_DIR" | while read FILE
     do
-        # Case-insensitive check for .flac extension
         if [[ "${FILE,,}" == *.flac ]]; then
             echo "Detected new FLAC via import: $FILE"
             OPUS_FILE="${FILE%.*}.opus"
             
-            # Transcode (preserves tags natively in newer ffmpeg versions)
             ffmpeg -y -i "$FILE" -acodec libopus -ac 2 -ab 160k "$OPUS_FILE"
             
             if [ $? -eq 0 ]; then
                 echo "Transcode successful. Removing original FLAC..."
                 rm "$FILE"
                 
-                echo "Triggering DroppedNeedle library scan..."
-                # Calls the DroppedNeedle service using internal Kubernetes DNS
-                curl -X POST http://droppedneedle.default.svc.cluster.local:8688/api/v1/library/scan/start
+                echo "Triggering authenticated DroppedNeedle library scan..."
+                # 1. Authenticate and save the session cookie to a temporary jar
+                curl -s -X POST http://droppedneedle.default.svc.cluster.local:80/api/v1/auth/login \
+                     -H "Content-Type: application/json" \
+                     -d "{\"username\": \"$SERVICE_USER\", \"password\": \"$SERVICE_PASS\"}" \
+                     -c /tmp/dn_cookies.txt
+                
+                # 2. Trigger the scan using the saved session cookie
+                curl -s -X POST http://droppedneedle.default.svc.cluster.local:80/api/v1/library/scan/start \
+                     -b /tmp/dn_cookies.txt
+                
+                # 3. Clean up the cookie jar
+                rm /tmp/dn_cookies.txt
             else
                 echo "Error: FFmpeg transcode failed for $FILE"
             fi
@@ -36,10 +43,11 @@ data:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: droppedneedle-transcoder
   name: droppedneedle-transcoder
-  namespace: default
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
@@ -50,23 +58,27 @@ spec:
       labels:
         app: droppedneedle-transcoder
     spec:
+      nodeSelector:
+        kubernetes.io/hostname: robin
       containers:
         - name: transcoder
           image: alpine:latest
           command: ["/bin/sh", "-c"]
           args:
             - "apk add --no-cache bash inotify-tools ffmpeg curl && bash /scripts/transcode.sh"
+          envFrom:
+            - secretRef:
+                name: droppedneedle-secret
           volumeMounts:
-            - mountPath: /yarr
+            - mountPath: /music
               name: yarr
             - mountPath: /scripts
               name: script-volume
       restartPolicy: Always
       volumes:
         - name: yarr
-          nfs:
-            server: robin.home.nest
-            path: /yarr
+          persistentVolumeClaim:
+            claimName: droppedneedle-transcode-pvc
         - name: script-volume
           configMap:
             name: droppedneedle-transcoder-script
diff --git a/services/flaresolverr/flaresolverr-deployment.yaml b/services/flaresolverr/flaresolverr-deployment.yaml
index 40f67c7..d11d961 100644
--- a/services/flaresolverr/flaresolverr-deployment.yaml
+++ b/services/flaresolverr/flaresolverr-deployment.yaml
@@ -1,24 +1,20 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: flaresolverr
   name: flaresolverr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: flaresolverr
+      app: flaresolverr
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: flaresolverr
+        app: flaresolverr
     spec:
       containers:
         - env:
diff --git a/services/flaresolverr/flaresolverr-service.yaml b/services/flaresolverr/flaresolverr-service.yaml
index a8676a7..a3fc8db 100644
--- a/services/flaresolverr/flaresolverr-service.yaml
+++ b/services/flaresolverr/flaresolverr-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: flaresolverr
   name: flaresolverr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: flaresolverr
   selector:
-    io.kompose.service: flaresolverr
+    app: flaresolverr
diff --git a/services/foundryvtt/foundry-vtt-deployment.yaml b/services/foundryvtt/foundry-vtt-deployment.yaml
index e4b7401..e6a258b 100644
--- a/services/foundryvtt/foundry-vtt-deployment.yaml
+++ b/services/foundryvtt/foundry-vtt-deployment.yaml
@@ -2,6 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: foundry-vtt
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
@@ -41,18 +45,3 @@ spec:
         - name: foundry-vtt-volume
           persistentVolumeClaim:
             claimName: foundry-vtt-data-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: foundry-vtt-data-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 10Gi
diff --git a/services/foundryvtt/foundry-vtt-ingress.yaml b/services/foundryvtt/foundry-vtt-ingress.yaml
index dc6a293..7a94772 100644
--- a/services/foundryvtt/foundry-vtt-ingress.yaml
+++ b/services/foundryvtt/foundry-vtt-ingress.yaml
@@ -6,7 +6,6 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.middlewares: security-auth-foundryvtt@kubernetescrd
 spec:
   ingressClassName: traefik
   tls:
@@ -24,29 +23,3 @@ spec:
             name: foundry-vtt
             port:
               name: http-web
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: foundry-auth-ingress
-  namespace: security # MOVED TO SECURITY NAMESPACE
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-spec:
-  ingressClassName: traefik
-  tls:
-  - hosts:
-    - foundry.mynest.love
-    secretName: foundry-vtt-tls
-  rules:
-  - host: foundry.mynest.love
-    http:
-      paths:
-      - path: /oauth2
-        pathType: Prefix
-        backend:
-          service:
-            name: oauth2-proxy-foundryvtt
-            port:
-              number: 4180
diff --git a/services/foundryvtt/foundry-vtt-oauth2-proxy.yaml b/services/foundryvtt/foundry-vtt-oauth2-proxy.yaml
deleted file mode 100644
index c7d4c4b..0000000
--- a/services/foundryvtt/foundry-vtt-oauth2-proxy.yaml
+++ /dev/null
@@ -1,86 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: foundryvtt-proxy-foundryvtt
-  namespace: security
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: oauth2-proxy-foundryvtt
-  template:
-    metadata:
-      labels:
-        app: oauth2-proxy-foundryvtt
-    spec:
-      containers:
-      - name: oauth2-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
-        envFrom:
-          - secretRef:
-              name: foundry-oauth-secrets
-        args:
-          - "--provider=oidc"
-          - "--oidc-issuer-url=https://sso.mynest.love/realms/nest"
-          - "--oidc-groups-claim=groups"
-          - "--redirect-url=https://foundry.mynest.love/oauth2/callback"
-          - "--email-domain=*"
-          - "--allowed-group=foundryvtt"
-          - "--skip-provider-button=true"
-          - "--cookie-secure=true"
-          - "--cookie-domain=foundry.mynest.love"
-          - "--http-address=0.0.0.0:4180"
-          - "--reverse-proxy=true"
-          - "--upstream=static://200"
-          - "--whitelist-domain=foundry.mynest.love"
-        ports:
-          - containerPort: 4180
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: foundry-oauth-secrets
-  namespace: security
-spec:
-  refreshInterval: "1h"
-  secretStoreRef:
-    name: vault-external-secrets-store
-    kind: ClusterSecretStore
-  target:
-    name: foundry-oauth-secrets
-    creationPolicy: Owner
-  data:
-  - secretKey: OAUTH2_PROXY_CLIENT_ID
-    remoteRef:
-      key: oauth2-proxy/foundryvtt
-      property: client-id
-  - secretKey: OAUTH2_PROXY_CLIENT_SECRET
-    remoteRef:
-      key: oauth2-proxy/foundryvtt
-      property: client-secret
-  - secretKey: OAUTH2_PROXY_COOKIE_SECRET
-    remoteRef:
-      key: oauth2-proxy/foundryvtt
-      property: cookie-secret
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: oauth2-proxy-foundryvtt
-  namespace: security
-spec:
-  ports:
-  - port: 4180
-    targetPort: 4180
-  selector:
-    app: oauth2-proxy-foundryvtt
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: auth-foundryvtt
-  namespace: security
-spec:
-  forwardAuth:
-    address: "http://oauth2-proxy-foundryvtt.security.svc.cluster.local:4180"
-    trustForwardHeader: true
diff --git a/services/foundryvtt/foundry-vtt-pvcs.yaml b/services/foundryvtt/foundry-vtt-pvcs.yaml
new file mode 100644
index 0000000..6d058ab
--- /dev/null
+++ b/services/foundryvtt/foundry-vtt-pvcs.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: foundry-vtt-data-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi
diff --git a/services/jellyfin/jellyfin-deployment.yaml b/services/jellyfin/jellyfin-deployment.yaml
index 06a12d7..b0f519a 100644
--- a/services/jellyfin/jellyfin-deployment.yaml
+++ b/services/jellyfin/jellyfin-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-jellyfin.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: jellyfin
   name: jellyfin
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: jellyfin
+      app: jellyfin
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-jellyfin.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: jellyfin
+        app: jellyfin
     spec:
       containers:
         - env:
@@ -53,33 +49,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/media
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 3Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyfin-cache-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 3Gi
diff --git a/services/droppedneedle/droppedneedle-pvc.yaml b/services/jellyfin/jellyfin-pvcs.yaml
similarity index 76%
rename from services/droppedneedle/droppedneedle-pvc.yaml
rename to services/jellyfin/jellyfin-pvcs.yaml
index 33c312c..87611c2 100644
--- a/services/droppedneedle/droppedneedle-pvc.yaml
+++ b/services/jellyfin/jellyfin-pvcs.yaml
@@ -1,9 +1,7 @@
-# Note: This service changed name from musicseerr to droppedneedle
-# PVC names are immutable, so just keeping the old names
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: musicseerr-config-pvc
+  name: jellyfin-config-pvc
   labels:
     recurring-job.longhorn.io/source: "enabled"
     recurring-job-group.longhorn.io/app-config-group: "enabled"
@@ -18,7 +16,7 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: musicseerr-cache-pvc
+  name: jellyfin-cache-pvc
   labels:
     recurring-job.longhorn.io/source: "enabled"
     recurring-job-group.longhorn.io/app-config-group: "enabled"
diff --git a/services/jellyfin/jellyfin-service.yaml b/services/jellyfin/jellyfin-service.yaml
index 1451810..3c5f8c7 100644
--- a/services/jellyfin/jellyfin-service.yaml
+++ b/services/jellyfin/jellyfin-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-jellyfin.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: jellyfin
   name: jellyfin
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: jellyfin
+    app: jellyfin
diff --git a/services/keycloak/keycloak-pvc.yaml b/services/keycloak/keycloak-pvc.yaml
index f4edb4f..e999cf8 100644
--- a/services/keycloak/keycloak-pvc.yaml
+++ b/services/keycloak/keycloak-pvc.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: security
   labels:
     recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/critical-data: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
 spec:
   accessModes: ["ReadWriteOnce"]
   storageClassName: "longhorn"
diff --git a/services/prowlarr/prowlarr-deployment.yaml b/services/prowlarr/prowlarr-deployment.yaml
index 39681cd..42d87c2 100644
--- a/services/prowlarr/prowlarr-deployment.yaml
+++ b/services/prowlarr/prowlarr-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: prowlarr
   name: prowlarr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: prowlarr
+      app: prowlarr
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: prowlarr
+        app: prowlarr
     spec:
       containers:
         - env:
diff --git a/services/prowlarr/prowlarr-service.yaml b/services/prowlarr/prowlarr-service.yaml
index 036f19c..cc513fb 100644
--- a/services/prowlarr/prowlarr-service.yaml
+++ b/services/prowlarr/prowlarr-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: prowlarr
   name: prowlarr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: prowlarr
+    app: prowlarr
diff --git a/services/radarr-anime/radarr-anime-deployment.yaml b/services/radarr-anime/radarr-anime-deployment.yaml
index 1410473..54aa79d 100644
--- a/services/radarr-anime/radarr-anime-deployment.yaml
+++ b/services/radarr-anime/radarr-anime-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: radarr-anime
   name: radarr-anime
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: radarr-anime
+      app: radarr-anime
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: radarr-anime
+        app: radarr-anime
     spec:
       containers:
         - env:
@@ -56,18 +52,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-anime-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 150Mi
diff --git a/services/radarr-anime/radarr-anime-pvcs.yaml b/services/radarr-anime/radarr-anime-pvcs.yaml
new file mode 100644
index 0000000..4349437
--- /dev/null
+++ b/services/radarr-anime/radarr-anime-pvcs.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-anime-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 150Mi
diff --git a/services/radarr-anime/radarr-anime-service.yaml b/services/radarr-anime/radarr-anime-service.yaml
index 1492406..b02cbbe 100644
--- a/services/radarr-anime/radarr-anime-service.yaml
+++ b/services/radarr-anime/radarr-anime-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: radarr-anime
   name: radarr-anime
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: radarr-anime
+    app: radarr-anime
diff --git a/services/radarr/radarr-deployment.yaml b/services/radarr/radarr-deployment.yaml
index 66dc251..e9af4ca 100644
--- a/services/radarr/radarr-deployment.yaml
+++ b/services/radarr/radarr-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: radarr
   name: radarr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: radarr
+      app: radarr
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: radarr
+        app: radarr
     spec:
       containers:
         - env:
@@ -56,18 +52,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 150Mi
diff --git a/services/radarr/radarr-pvcs.yaml b/services/radarr/radarr-pvcs.yaml
new file mode 100644
index 0000000..661e293
--- /dev/null
+++ b/services/radarr/radarr-pvcs.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: radarr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 150Mi
diff --git a/services/radarr/radarr-service.yaml b/services/radarr/radarr-service.yaml
index 61ccc83..36d3d0b 100644
--- a/services/radarr/radarr-service.yaml
+++ b/services/radarr/radarr-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: radarr
   name: radarr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: radarr
+    app: radarr
diff --git a/services/sabnzbd/sabnzbd-deployment.yaml b/services/sabnzbd/sabnzbd-deployment.yaml
index 57331c3..a94991d 100644
--- a/services/sabnzbd/sabnzbd-deployment.yaml
+++ b/services/sabnzbd/sabnzbd-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sabnzbd
   name: sabnzbd
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: sabnzbd
+      app: sabnzbd
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: sabnzbd
+        app: sabnzbd
     spec:
       containers:
         - env:
@@ -50,18 +46,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sabnzbd-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 50Mi
diff --git a/services/sabnzbd/sabnzbd-pvcs.yaml b/services/sabnzbd/sabnzbd-pvcs.yaml
new file mode 100644
index 0000000..584829c
--- /dev/null
+++ b/services/sabnzbd/sabnzbd-pvcs.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sabnzbd-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 50Mi
diff --git a/services/sabnzbd/sabnzbd-service.yaml b/services/sabnzbd/sabnzbd-service.yaml
index d4e80c5..f4a3523 100644
--- a/services/sabnzbd/sabnzbd-service.yaml
+++ b/services/sabnzbd/sabnzbd-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sabnzbd
   name: sabnzbd
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: sabnzbd
+    app: sabnzbd
diff --git a/services/seerr/seerr-deployment.yaml b/services/seerr/seerr-deployment.yaml
index 86d347e..9eaca72 100644
--- a/services/seerr/seerr-deployment.yaml
+++ b/services/seerr/seerr-deployment.yaml
@@ -1,9 +1,11 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: seerr
   name: seerr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
diff --git a/services/shelfmark/shelfmark-deployment.yaml b/services/shelfmark/shelfmark-deployment.yaml
index 7793269..f38141d 100644
--- a/services/shelfmark/shelfmark-deployment.yaml
+++ b/services/shelfmark/shelfmark-deployment.yaml
@@ -2,9 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: shelfmark
-  namespace: default
   annotations:
-    reloader.stakater.com/auto: "true"
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   strategy:
diff --git a/services/slskd/slskd-deployment.yaml b/services/slskd/slskd-deployment.yaml
index df544ba..6649133 100644
--- a/services/slskd/slskd-deployment.yaml
+++ b/services/slskd/slskd-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: slskd
   name: slskd
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: slskd
+      app: slskd
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: slskd
+        app: slskd
     spec:
       containers:
         - env:
diff --git a/services/slskd/slskd-service.yaml b/services/slskd/slskd-service.yaml
index be969f4..a0859c3 100644
--- a/services/slskd/slskd-service.yaml
+++ b/services/slskd/slskd-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: slskd
   name: slskd
 spec:
   type: ClusterIP
@@ -17,4 +12,4 @@ spec:
       port: 81
       targetPort: slskd-listen
   selector:
-    io.kompose.service: slskd
+    app: slskd
diff --git a/services/sonarr-anime/sonarr-anime-deployment.yaml b/services/sonarr-anime/sonarr-anime-deployment.yaml
index 35ce516..6f83707 100644
--- a/services/sonarr-anime/sonarr-anime-deployment.yaml
+++ b/services/sonarr-anime/sonarr-anime-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sonarr-anime
   name: sonarr-anime
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: sonarr-anime
+      app: sonarr-anime
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: sonarr-anime
+        app: sonarr-anime
     spec:
       containers:
         - env:
@@ -56,18 +52,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-anime-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 200Mi
diff --git a/services/sonarr-anime/sonarr-anime-pvcs.yaml b/services/sonarr-anime/sonarr-anime-pvcs.yaml
new file mode 100644
index 0000000..e595895
--- /dev/null
+++ b/services/sonarr-anime/sonarr-anime-pvcs.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-anime-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 200Mi
diff --git a/services/sonarr-anime/sonarr-anime-service.yaml b/services/sonarr-anime/sonarr-anime-service.yaml
index 6e1f0a2..d62c812 100644
--- a/services/sonarr-anime/sonarr-anime-service.yaml
+++ b/services/sonarr-anime/sonarr-anime-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sonarr-anime
   name: sonarr-anime
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: sonarr-anime
+    app: sonarr-anime
diff --git a/services/sonarr/sonarr-deployment.yaml b/services/sonarr/sonarr-deployment.yaml
index 7ad296b..d8040b7 100644
--- a/services/sonarr/sonarr-deployment.yaml
+++ b/services/sonarr/sonarr-deployment.yaml
@@ -1,26 +1,22 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sonarr
   name: sonarr
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
     matchLabels:
-      io.kompose.service: sonarr
+      app: sonarr
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-yarr.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: sonarr
+        app: sonarr
     spec:
       containers:
         - env:
@@ -56,18 +52,3 @@ spec:
           nfs:
             server: robin.home.nest
             path: /yarr/downloads
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr-config-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 150Mi
diff --git a/services/sonarr/sonarr-pvcs.yaml b/services/sonarr/sonarr-pvcs.yaml
new file mode 100644
index 0000000..5cf2e32
--- /dev/null
+++ b/services/sonarr/sonarr-pvcs.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: sonarr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 150Mi
diff --git a/services/sonarr/sonarr-service.yaml b/services/sonarr/sonarr-service.yaml
index 1425248..fe78dea 100644
--- a/services/sonarr/sonarr-service.yaml
+++ b/services/sonarr/sonarr-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-yarr.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: sonarr
   name: sonarr
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: web-ui
   selector:
-    io.kompose.service: sonarr
+    app: sonarr
diff --git a/services/tdarr/tdarr-deployment.yaml b/services/tdarr/tdarr-deployment.yaml
index 6c210c8..d7dc858 100644
--- a/services/tdarr/tdarr-deployment.yaml
+++ b/services/tdarr/tdarr-deployment.yaml
@@ -2,6 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: tdarr-server
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
@@ -62,6 +66,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: tdarr-node-cpu
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   replicas: 1
   selector:
diff --git a/services/tdarr/tdarr-pvcs.yaml b/services/tdarr/tdarr-pvcs.yaml
index a35b36d..78a4511 100644
--- a/services/tdarr/tdarr-pvcs.yaml
+++ b/services/tdarr/tdarr-pvcs.yaml
@@ -2,6 +2,9 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: tdarr-config-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
 spec:
   accessModes:
     - ReadWriteOnce
@@ -14,6 +17,9 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: tdarr-cache-rwx
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
 spec:
   accessModes:
     - ReadWriteMany
@@ -26,6 +32,9 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: tdarr-db-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
 spec:
   accessModes:
     - ReadWriteOnce
diff --git a/services/vaultwarden/vaultwarden-deployment.yaml b/services/vaultwarden/vaultwarden-deployment.yaml
index 96ca68a..2662cb8 100644
--- a/services/vaultwarden/vaultwarden-deployment.yaml
+++ b/services/vaultwarden/vaultwarden-deployment.yaml
@@ -1,25 +1,21 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: vaultwarden
   name: vaultwarden
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
 spec:
   selector:
     matchLabels:
-      io.kompose.service: vaultwarden
+      app: vaultwarden
   strategy:
     type: Recreate
   template:
     metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose.yaml
-        kompose.version: 1.38.0 (HEAD)
       labels:
-        io.kompose.service: vaultwarden
+        app: vaultwarden
     spec:
       containers:
         - env:
@@ -44,18 +40,3 @@ spec:
         - name: vaultwarden-volume
           persistentVolumeClaim:
             claimName: vaultwarden-data-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vaultwarden-data-pvc
-  labels:
-    recurring-job.longhorn.io/source: "enabled"
-    recurring-job-group.longhorn.io/app-config-group: "enabled"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 40Mi
diff --git a/services/vaultwarden/vaultwarden-pvcs.yaml b/services/vaultwarden/vaultwarden-pvcs.yaml
new file mode 100644
index 0000000..424191d
--- /dev/null
+++ b/services/vaultwarden/vaultwarden-pvcs.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-data-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 40Mi
diff --git a/services/vaultwarden/vaultwarden-service.yaml b/services/vaultwarden/vaultwarden-service.yaml
index 35d8fbd..ff93ded 100644
--- a/services/vaultwarden/vaultwarden-service.yaml
+++ b/services/vaultwarden/vaultwarden-service.yaml
@@ -1,11 +1,6 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: vaultwarden
   name: vaultwarden
 spec:
   type: ClusterIP
@@ -14,4 +9,4 @@ spec:
       port: 80
       targetPort: http
   selector:
-    io.kompose.service: vaultwarden
+    app: vaultwarden
diff --git a/services/system-upgrade-controller/system-upgrade-controller.yaml b/system-upgrade-controller/system-upgrade-controller.yaml
similarity index 100%
rename from services/system-upgrade-controller/system-upgrade-controller.yaml
rename to system-upgrade-controller/system-upgrade-controller.yaml