diff --git a/kubernetes/apps/media/autobrr/app/helmrelease.yaml b/kubernetes/apps/media/autobrr/app/helmrelease.yaml
index 56699ecd0..5f3545c4d 100644
--- a/kubernetes/apps/media/autobrr/app/helmrelease.yaml
+++ b/kubernetes/apps/media/autobrr/app/helmrelease.yaml
@@ -74,7 +74,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:bunny
         hosts:
-          - host: &host autobrr.${PRIVATE_DOMAIN}
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -82,7 +82,7 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
     persistence:
       config:
         enabled: true
diff --git a/kubernetes/apps/media/autobrr/ks.yaml b/kubernetes/apps/media/autobrr/ks.yaml
index e5e78f6df..1dcc80a8b 100644
--- a/kubernetes/apps/media/autobrr/ks.yaml
+++ b/kubernetes/apps/media/autobrr/ks.yaml
@@ -2,10 +2,16 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-autobrr
+  name: &appname autobrr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
+    - name: cluster-apps-volsync
+    - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/autobrr/app
@@ -17,3 +23,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: autobrr.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/bazarr/app/helmrelease.yaml b/kubernetes/apps/media/bazarr/app/helmrelease.yaml
index d5d144e9a..62328109b 100644
--- a/kubernetes/apps/media/bazarr/app/helmrelease.yaml
+++ b/kubernetes/apps/media/bazarr/app/helmrelease.yaml
@@ -96,7 +96,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:subtitles-outline
         hosts:
-          - host: &host "bazarr.${PRIVATE_DOMAIN}"
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -104,13 +104,13 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
     persistence:
       add-ons:
         type: emptyDir
       config:
         enabled: true
-        existingClaim: bazarr-config
+        existingClaim: "${VOLSYNC_CLAIM}"
       config-cache:
         type: emptyDir
         globalMounts:
diff --git a/kubernetes/apps/media/bazarr/app/kustomization.yaml b/kubernetes/apps/media/bazarr/app/kustomization.yaml
index 83a6382ac..c4f1130ab 100644
--- a/kubernetes/apps/media/bazarr/app/kustomization.yaml
+++ b/kubernetes/apps/media/bazarr/app/kustomization.yaml
@@ -3,17 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: media
 resources:
-  - ./pvc.yaml
+  - ./volsync.yaml
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ./volsync.yaml
 configMapGenerator:
   - name: bazarr-scripts
     files:
       - ./scripts/post-process.sh
 generatorOptions:
   disableNameSuffixHash: true
-labels:
-  - pairs:
-      app.kubernetes.io/name: bazarr
-      app.kubernetes.io/instance: bazarr
diff --git a/kubernetes/apps/media/bazarr/app/pvc.yaml b/kubernetes/apps/media/bazarr/app/pvc.yaml
deleted file mode 100644
index 5648cb3db..000000000
--- a/kubernetes/apps/media/bazarr/app/pvc.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: bazarr-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
diff --git a/kubernetes/apps/media/bazarr/app/volsync.yaml b/kubernetes/apps/media/bazarr/app/volsync.yaml
index 04ff33fbc..0c2179c1b 100644
--- a/kubernetes/apps/media/bazarr/app/volsync.yaml
+++ b/kubernetes/apps/media/bazarr/app/volsync.yaml
@@ -3,7 +3,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: bazarr-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -22,22 +21,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: bazarr
-  namespace: media
 spec:
-  sourcePVC: bazarr-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: bazarr-rdst
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: bazarr-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: bazarr-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 2Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: bazarr-rsrc
+spec:
+  sourcePVC: bazarr
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: bazarr-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
diff --git a/kubernetes/apps/media/bazarr/ks.yaml b/kubernetes/apps/media/bazarr/ks.yaml
index 91008cd6b..2ed898190 100644
--- a/kubernetes/apps/media/bazarr/ks.yaml
+++ b/kubernetes/apps/media/bazarr/ks.yaml
@@ -2,12 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-bazarr
+  name: &appname bazarr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
     - name: cluster-apps-volsync
-    - name: cluster-apps-pvc-media-data
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
@@ -20,3 +23,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: bazarr.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/feishin/app/helmrelease.yaml b/kubernetes/apps/media/feishin/app/helmrelease.yaml
index 011b3ad92..c48e1eb37 100644
--- a/kubernetes/apps/media/feishin/app/helmrelease.yaml
+++ b/kubernetes/apps/media/feishin/app/helmrelease.yaml
@@ -41,7 +41,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:headphones
         hosts:
-          - host: &host "feishin.${PRIVATE_DOMAIN}"
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -49,11 +49,11 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
     persistence:
       config:
         enabled: true
-        existingClaim: *app
+        existingClaim: "${VOLSYNC_CLAIM}"
     service:
       main:
         ports:
diff --git a/kubernetes/apps/media/feishin/ks.yaml b/kubernetes/apps/media/feishin/ks.yaml
index 4375140d8..df412b79b 100644
--- a/kubernetes/apps/media/feishin/ks.yaml
+++ b/kubernetes/apps/media/feishin/ks.yaml
@@ -2,11 +2,18 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-feishin
+  name: &appname feishin
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
-    - name: cluster-apps-navidrome
+    - name: cluster-apps-volsync
+    - name: cluster-apps-rook-ceph-cluster
+    - name: cluster-apps-external-secrets-stores
+    - name: navidrome
   path: ./kubernetes/apps/media/feishin/app
   prune: true
   sourceRef:
@@ -16,3 +23,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: graves.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/flaresolverr/ks.yaml b/kubernetes/apps/media/flaresolverr/ks.yaml
index 427aaa32e..0b4daeffd 100644
--- a/kubernetes/apps/media/flaresolverr/ks.yaml
+++ b/kubernetes/apps/media/flaresolverr/ks.yaml
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-flaresolverr
+  name: &appname flaresolverr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   path: ./kubernetes/apps/media/flaresolverr/app
   prune: true
   sourceRef:
@@ -14,3 +18,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: flaresolverr.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/jellyfin/app/helmrelease.yaml b/kubernetes/apps/media/jellyfin/app/helmrelease.yaml
index 16ed879f5..e375a6cbb 100644
--- a/kubernetes/apps/media/jellyfin/app/helmrelease.yaml
+++ b/kubernetes/apps/media/jellyfin/app/helmrelease.yaml
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: &app jellyfin
+  name: jellyfin
   namespace: media
 spec:
   interval: 30m
diff --git a/kubernetes/apps/media/jellyfin/app/volsync.yaml b/kubernetes/apps/media/jellyfin/app/volsync.yaml
index 524f53ae9..20bd6832c 100644
--- a/kubernetes/apps/media/jellyfin/app/volsync.yaml
+++ b/kubernetes/apps/media/jellyfin/app/volsync.yaml
@@ -24,7 +24,7 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-config
+  name: jellyfin
 spec:
   accessModes: ["ReadWriteOnce"]
   dataSourceRef:
diff --git a/kubernetes/apps/media/jellyfin/ks.yaml b/kubernetes/apps/media/jellyfin/ks.yaml
index 47bdc5fd3..709e6f0d1 100644
--- a/kubernetes/apps/media/jellyfin/ks.yaml
+++ b/kubernetes/apps/media/jellyfin/ks.yaml
@@ -11,7 +11,6 @@ spec:
       app.kubernetes.io/name: *appname
   dependsOn:
     - name: cluster-apps-volsync
-    - name: cluster-apps-pvc-media-data
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/jellyfin/app
@@ -29,4 +28,4 @@ spec:
       HOSTNAME: jellyfin.${PRIVATE_DOMAIN}
       APP_UID: "568"
       APP_GID: "568"
-      VOLSYNC_CLAIM: jellyfin-config
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/jellyseer/app/helmrelease.yaml b/kubernetes/apps/media/jellyseer/app/helmrelease.yaml
index 12af69332..a1bc7cab7 100644
--- a/kubernetes/apps/media/jellyseer/app/helmrelease.yaml
+++ b/kubernetes/apps/media/jellyseer/app/helmrelease.yaml
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: &app jellyseer
+  name: jellyseer
   namespace: media
 spec:
   interval: 30m
@@ -43,7 +43,7 @@ spec:
     persistence:
       config:
         enabled: true
-        existingClaim: jellyseer-config
+        existingClaim: "${VOLSYNC_CLAIM}"
         mountPath: /app/config
     service:
       main:
@@ -58,7 +58,7 @@ spec:
           hajimari.io/icon: mdi:eye-circle
           external-dns.alpha.kubernetes.io/target: external.${PRIVATE_DOMAIN}
         hosts:
-          - host: &host "requests.${PRIVATE_DOMAIN}"
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -66,4 +66,4 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
diff --git a/kubernetes/apps/media/jellyseer/app/kustomization.yaml b/kubernetes/apps/media/jellyseer/app/kustomization.yaml
index 7784d2d8c..fe6b401ef 100644
--- a/kubernetes/apps/media/jellyseer/app/kustomization.yaml
+++ b/kubernetes/apps/media/jellyseer/app/kustomization.yaml
@@ -3,10 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: media
 resources:
-  - ./pvc.yaml
-  - ./helmrelease.yaml
   - ./volsync.yaml
-labels:
-  - pairs:
-      app.kubernetes.io/name: jellyseer
-      app.kubernetes.io/instance: jellyseer
+  - ./helmrelease.yaml
diff --git a/kubernetes/apps/media/jellyseer/app/pvc.yaml b/kubernetes/apps/media/jellyseer/app/pvc.yaml
deleted file mode 100644
index 3d904fd0a..000000000
--- a/kubernetes/apps/media/jellyseer/app/pvc.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellyseer-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
diff --git a/kubernetes/apps/media/jellyseer/app/volsync.yaml b/kubernetes/apps/media/jellyseer/app/volsync.yaml
index 4fcfe70d1..d7eb70892 100644
--- a/kubernetes/apps/media/jellyseer/app/volsync.yaml
+++ b/kubernetes/apps/media/jellyseer/app/volsync.yaml
@@ -3,7 +3,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: jellyseer-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -22,22 +21,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: jellyseer
-  namespace: media
 spec:
-  sourcePVC: jellyseer-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: jellyseer-rdst
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: jellyseer-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: jellyseer-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 5Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: jellyseer-rsrc
+spec:
+  sourcePVC: jellyseer
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: jellyseer-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
diff --git a/kubernetes/apps/media/jellyseer/ks.yaml b/kubernetes/apps/media/jellyseer/ks.yaml
index d5748e420..0ff71bfb0 100644
--- a/kubernetes/apps/media/jellyseer/ks.yaml
+++ b/kubernetes/apps/media/jellyseer/ks.yaml
@@ -2,15 +2,18 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-jellyseer
+  name: &appname jellyseer
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
     - name: cluster-apps-volsync
-    - name: cluster-apps-pvc-media-data
     - name: cluster-apps-rook-ceph-cluster
-    - name: cluster-apps-jellyfin
     - name: cluster-apps-external-secrets-stores
+    - name: jellyfin
   path: ./kubernetes/apps/media/jellyseer/app
   prune: true
   sourceRef:
@@ -20,3 +23,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: requests.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/lidarr/app/helmrelease.yaml b/kubernetes/apps/media/lidarr/app/helmrelease.yaml
index dca65fe5e..a9d98e585 100644
--- a/kubernetes/apps/media/lidarr/app/helmrelease.yaml
+++ b/kubernetes/apps/media/lidarr/app/helmrelease.yaml
@@ -47,10 +47,10 @@ spec:
     persistence:
       config:
         enabled: true
-        existingClaim: lidarr-config
+        existingClaim: "${VOLSYNC_CLAIM}"
       config-deemix:
         enabled: true
-        existingClaim: deemix-config
+        existingClaim: deemix
       media:
         type: nfs
         server: nas.${PRIVATE_DOMAIN}
@@ -71,7 +71,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:headphones
         hosts:
-          - host: &host "lidarr.${PRIVATE_DOMAIN}"
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -85,5 +85,5 @@ spec:
                   port: deemix
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
               - *host2
diff --git a/kubernetes/apps/media/lidarr/app/pvc.yaml b/kubernetes/apps/media/lidarr/app/pvc.yaml
deleted file mode 100644
index f02603522..000000000
--- a/kubernetes/apps/media/lidarr/app/pvc.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: lidarr-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: deemix-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
diff --git a/kubernetes/apps/media/lidarr/app/volsync.yaml b/kubernetes/apps/media/lidarr/app/volsync.yaml
index 2a38c0528..7800432dc 100644
--- a/kubernetes/apps/media/lidarr/app/volsync.yaml
+++ b/kubernetes/apps/media/lidarr/app/volsync.yaml
@@ -3,7 +3,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: lidarr-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -22,22 +21,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: lidarr
-  namespace: media
 spec:
-  sourcePVC: lidarr-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: lidarr-rdst
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: lidarr-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: lidarr-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 10Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: lidarr-rsrc
+spec:
+  sourcePVC: lidarr
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: lidarr-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
@@ -51,7 +88,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: deemix-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -70,22 +106,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: deemix
-  namespace: media
 spec:
-  sourcePVC: deemix-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: deemix-rdst
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: deemix-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: deemix-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 10Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: deemix-rsrc
+spec:
+  sourcePVC: deemix
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: deemix-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
diff --git a/kubernetes/apps/media/lidarr/ks.yaml b/kubernetes/apps/media/lidarr/ks.yaml
index cb1b2fabb..b9feab666 100644
--- a/kubernetes/apps/media/lidarr/ks.yaml
+++ b/kubernetes/apps/media/lidarr/ks.yaml
@@ -2,13 +2,16 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-lidarr
+  name: &appname lidarr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
-    - name: cluster-apps-pvc-media-data
+    - name: cluster-apps-volsync
     - name: cluster-apps-rook-ceph-cluster
-    - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/lidarr/app
   prune: true
@@ -19,3 +22,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: lidarr.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/navidrome/app/helmrelease.yaml b/kubernetes/apps/media/navidrome/app/helmrelease.yaml
index cbc6f584a..aadaef112 100644
--- a/kubernetes/apps/media/navidrome/app/helmrelease.yaml
+++ b/kubernetes/apps/media/navidrome/app/helmrelease.yaml
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: &app navidrome
+  name: navidrome
   namespace: media
 spec:
   interval: 30m
@@ -67,7 +67,7 @@ spec:
           hajimari.io/icon: mdi:music
           external-dns.alpha.kubernetes.io/target: external.${PRIVATE_DOMAIN}
         hosts:
-          - host: &host "music.${PRIVATE_DOMAIN}"
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -75,11 +75,11 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
     persistence:
       config:
         enabled: true
-        existingClaim: navidrome-config
+        existingClaim: "${VOLSYNC_CLAIM}"
       media-data:
         type: nfs
         server: nas.${PRIVATE_DOMAIN}
diff --git a/kubernetes/apps/media/navidrome/app/kustomization.yaml b/kubernetes/apps/media/navidrome/app/kustomization.yaml
index 9ba14d7be..3919e65c4 100644
--- a/kubernetes/apps/media/navidrome/app/kustomization.yaml
+++ b/kubernetes/apps/media/navidrome/app/kustomization.yaml
@@ -3,10 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: media
 resources:
-  - ./pvc.yaml
+  - ./volsync.yaml
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ./volsync.yaml
 labels:
   - pairs:
       app.kubernetes.io/name: navidrome
diff --git a/kubernetes/apps/media/navidrome/app/pvc.yaml b/kubernetes/apps/media/navidrome/app/pvc.yaml
deleted file mode 100644
index 4cf2968d6..000000000
--- a/kubernetes/apps/media/navidrome/app/pvc.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: navidrome-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
diff --git a/kubernetes/apps/media/navidrome/app/volsync.yaml b/kubernetes/apps/media/navidrome/app/volsync.yaml
index fb9ac176f..8c7dfb93a 100644
--- a/kubernetes/apps/media/navidrome/app/volsync.yaml
+++ b/kubernetes/apps/media/navidrome/app/volsync.yaml
@@ -3,7 +3,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: navidrome-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -22,22 +21,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: navidrome
-  namespace: media
 spec:
-  sourcePVC: navidrome-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: navidrome-rdst
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: navidrome-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: navidrome-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 1Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: navidrome-rsrc
+spec:
+  sourcePVC: navidrome
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: navidrome-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
diff --git a/kubernetes/apps/media/navidrome/ks.yaml b/kubernetes/apps/media/navidrome/ks.yaml
index bb6538f9d..df86c60f2 100644
--- a/kubernetes/apps/media/navidrome/ks.yaml
+++ b/kubernetes/apps/media/navidrome/ks.yaml
@@ -2,12 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-navidrome
+  name: &appname navidrome
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
     - name: cluster-apps-volsync
-    - name: cluster-apps-pvc-media-data
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/navidrome/app
@@ -19,3 +22,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: music.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/prowlarr/app/helmrelease.yaml b/kubernetes/apps/media/prowlarr/app/helmrelease.yaml
index f93ab6037..ec1f0458f 100644
--- a/kubernetes/apps/media/prowlarr/app/helmrelease.yaml
+++ b/kubernetes/apps/media/prowlarr/app/helmrelease.yaml
@@ -76,7 +76,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:movie-search
         hosts:
-          - host: &host prowlarr.${PRIVATE_DOMAIN}
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -84,7 +84,7 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
     persistence:
       config:
         enabled: true
diff --git a/kubernetes/apps/media/prowlarr/app/kustomization.yaml b/kubernetes/apps/media/prowlarr/app/kustomization.yaml
index 82994c9f0..8315e8380 100644
--- a/kubernetes/apps/media/prowlarr/app/kustomization.yaml
+++ b/kubernetes/apps/media/prowlarr/app/kustomization.yaml
@@ -5,7 +5,3 @@ namespace: media
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-labels:
-  - pairs:
-      app.kubernetes.io/name: prowlarr
-      app.kubernetes.io/instance: prowlarr
diff --git a/kubernetes/apps/media/prowlarr/ks.yaml b/kubernetes/apps/media/prowlarr/ks.yaml
index 30db1551c..818d99dea 100644
--- a/kubernetes/apps/media/prowlarr/ks.yaml
+++ b/kubernetes/apps/media/prowlarr/ks.yaml
@@ -2,10 +2,16 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-prowlarr
+  name: &appname prowlarr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
+    - name: cluster-apps-volsync
+    - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/prowlarr/app
@@ -17,3 +23,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: prowlarr.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml b/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml
index 0c439a708..49ed364e6 100644
--- a/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml
+++ b/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml
@@ -139,7 +139,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:seedling
         hosts:
-          - host: &host torrent.${PRIVATE_DOMAIN}
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -147,11 +147,11 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
     persistence:
       config:
         enabled: true
-        existingClaim: qbittorrent-config
+        existingClaim: "${VOLSYNC_CLAIM}"
       media-data:
         type: nfs
         server: nas.${PRIVATE_DOMAIN}
diff --git a/kubernetes/apps/media/qbittorrent/app/kustomization.yaml b/kubernetes/apps/media/qbittorrent/app/kustomization.yaml
index d8cdf20d6..e377c8c6f 100644
--- a/kubernetes/apps/media/qbittorrent/app/kustomization.yaml
+++ b/kubernetes/apps/media/qbittorrent/app/kustomization.yaml
@@ -3,10 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: media
 resources:
+  - ./volsync.yaml
   - ./externalsecret.yaml
-  - ./pvc.yaml
   - ./helmrelease.yaml
-  - ./volsync.yaml
 configMapGenerator:
   - name: cross-seed-config-tpl
     files:
@@ -16,7 +15,3 @@ configMapGenerator:
       - ./configs/dnsdist.conf
 generatorOptions:
   disableNameSuffixHash: true
-labels:
-  - pairs:
-      app.kubernetes.io/name: qbittorrent
-      app.kubernetes.io/instance: qbittorrent
diff --git a/kubernetes/apps/media/qbittorrent/app/pvc.yaml b/kubernetes/apps/media/qbittorrent/app/pvc.yaml
deleted file mode 100644
index ab8d529fa..000000000
--- a/kubernetes/apps/media/qbittorrent/app/pvc.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
diff --git a/kubernetes/apps/media/qbittorrent/app/volsync.yaml b/kubernetes/apps/media/qbittorrent/app/volsync.yaml
index f5e6a0278..4c36b487e 100644
--- a/kubernetes/apps/media/qbittorrent/app/volsync.yaml
+++ b/kubernetes/apps/media/qbittorrent/app/volsync.yaml
@@ -3,7 +3,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: qbittorrent-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -22,22 +21,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: qbittorrent
-  namespace: media
 spec:
-  sourcePVC: qbittorrent-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: qbittorrent-rdst
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: qbittorrent-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: qbittorrent-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 5Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: qbittorrent-rsrc
+spec:
+  sourcePVC: qbittorrent
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: qbittorrent-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
diff --git a/kubernetes/apps/media/qbittorrent/ks.yaml b/kubernetes/apps/media/qbittorrent/ks.yaml
index 2d7a73423..95c6803af 100644
--- a/kubernetes/apps/media/qbittorrent/ks.yaml
+++ b/kubernetes/apps/media/qbittorrent/ks.yaml
@@ -2,13 +2,16 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-qbittorrent
+  name: &appname qbittorrent
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
-    - name: cluster-apps-pvc-media-data
+    - name: cluster-apps-volsync
     - name: cluster-apps-rook-ceph-cluster
-    - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/qbittorrent/app
   prune: true
@@ -19,15 +22,28 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: qbittorrent.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-qbittorrent-tools
+  name: &appname qbittorrent-tools
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
-    - name: cluster-apps-qbittorrent
+    - name: cluster-apps-volsync
+    - name: cluster-apps-rook-ceph-cluster
+    - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/qbittorrent/tools
   prune: true
   sourceRef:
diff --git a/kubernetes/apps/media/qbittorrent/tools/orphaned/helmrelease.yaml b/kubernetes/apps/media/qbittorrent/tools/orphaned/helmrelease.yaml
index bdc73e20b..68e759517 100644
--- a/kubernetes/apps/media/qbittorrent/tools/orphaned/helmrelease.yaml
+++ b/kubernetes/apps/media/qbittorrent/tools/orphaned/helmrelease.yaml
@@ -52,7 +52,11 @@ spec:
               - 65536
     persistence:
       media-data:
-        existingClaim: media-data
+        type: nfs
+        server: nas.${PRIVATE_DOMAIN}
+        path: /mnt/data/media-data
+        globalMounts:
+          - path: /media-data
     service:
       main:
         enabled: false
diff --git a/kubernetes/apps/media/radarr/app/helmrelease.yaml b/kubernetes/apps/media/radarr/app/helmrelease.yaml
index d5612f570..481f7b88d 100644
--- a/kubernetes/apps/media/radarr/app/helmrelease.yaml
+++ b/kubernetes/apps/media/radarr/app/helmrelease.yaml
@@ -87,7 +87,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:filmstrip
         hosts:
-          - host: &host radarr.${PRIVATE_DOMAIN}
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -95,11 +95,11 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
     persistence:
       config:
         enabled: true
-        existingClaim: radarr-config
+        existingClaim: "${VOLSYNC_CLAIM}"
       media-data:
         type: nfs
         server: nas.${PRIVATE_DOMAIN}
diff --git a/kubernetes/apps/media/radarr/app/kustomization.yaml b/kubernetes/apps/media/radarr/app/kustomization.yaml
index fb7c7c157..358c9a027 100644
--- a/kubernetes/apps/media/radarr/app/kustomization.yaml
+++ b/kubernetes/apps/media/radarr/app/kustomization.yaml
@@ -3,11 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: media
 resources:
-  - ./pvc.yaml
+  - ./volsync.yaml
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ./volsync.yaml
-labels:
-  - pairs:
-      app.kubernetes.io/name: radarr
-      app.kubernetes.io/instance: radarr
diff --git a/kubernetes/apps/media/radarr/app/pvc.yaml b/kubernetes/apps/media/radarr/app/pvc.yaml
deleted file mode 100644
index 5fc352fef..000000000
--- a/kubernetes/apps/media/radarr/app/pvc.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
diff --git a/kubernetes/apps/media/radarr/app/volsync.yaml b/kubernetes/apps/media/radarr/app/volsync.yaml
index 9b2eb4b46..47eba8f5a 100644
--- a/kubernetes/apps/media/radarr/app/volsync.yaml
+++ b/kubernetes/apps/media/radarr/app/volsync.yaml
@@ -3,7 +3,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: radarr-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -22,22 +21,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: radarr
-  namespace: media
 spec:
-  sourcePVC: radarr-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: radarr-rdst
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: radarr-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: radarr-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 10Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: radarr-rsrc
+spec:
+  sourcePVC: radarr
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: radarr-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
diff --git a/kubernetes/apps/media/radarr/ks.yaml b/kubernetes/apps/media/radarr/ks.yaml
index 8312c9c46..f9b092999 100644
--- a/kubernetes/apps/media/radarr/ks.yaml
+++ b/kubernetes/apps/media/radarr/ks.yaml
@@ -2,11 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-radarr
+  name: &appname radarr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
-    - name: cluster-apps-pvc-media-data
+    - name: cluster-apps-volsync
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
@@ -19,3 +23,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: radarr.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/readarr/app/audiobooks/helmrelease.yaml b/kubernetes/apps/media/readarr/app/audiobooks/helmrelease.yaml
index 07ed98e86..95c1102c1 100644
--- a/kubernetes/apps/media/readarr/app/audiobooks/helmrelease.yaml
+++ b/kubernetes/apps/media/readarr/app/audiobooks/helmrelease.yaml
@@ -96,7 +96,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:book-music
         hosts:
-          - host: *host
+          - host: &host audiobooks.${PRIVATE_DOMAIN}
             paths:
               - path: /
                 service:
diff --git a/kubernetes/apps/media/readarr/app/audiobooks/kustomization.yaml b/kubernetes/apps/media/readarr/app/audiobooks/kustomization.yaml
index 7fea21a99..8315e8380 100644
--- a/kubernetes/apps/media/readarr/app/audiobooks/kustomization.yaml
+++ b/kubernetes/apps/media/readarr/app/audiobooks/kustomization.yaml
@@ -5,8 +5,3 @@ namespace: media
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-labels:
-  - pairs:
-      app.kubernetes.io/name: readarr-audiobooks
-      app.kubernetes.io/instance: readarr-audiobooks
-      app.kubernetes.io/part-of: readarr
diff --git a/kubernetes/apps/media/readarr/app/ebooks/helmrelease.yaml b/kubernetes/apps/media/readarr/app/ebooks/helmrelease.yaml
index 0d9f39a66..5bba8524e 100644
--- a/kubernetes/apps/media/readarr/app/ebooks/helmrelease.yaml
+++ b/kubernetes/apps/media/readarr/app/ebooks/helmrelease.yaml
@@ -96,7 +96,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:bookshelf
         hosts:
-          - host: *host
+          - host: &host ebooks.${PRIVATE_DOMAIN}
             paths:
               - path: /
                 service:
diff --git a/kubernetes/apps/media/readarr/app/ebooks/kustomization.yaml b/kubernetes/apps/media/readarr/app/ebooks/kustomization.yaml
index 53054a21a..8315e8380 100644
--- a/kubernetes/apps/media/readarr/app/ebooks/kustomization.yaml
+++ b/kubernetes/apps/media/readarr/app/ebooks/kustomization.yaml
@@ -5,8 +5,3 @@ namespace: media
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-labels:
-  - pairs:
-      app.kubernetes.io/name: readarr-ebooks
-      app.kubernetes.io/instance: readarr-ebooks
-      app.kubernetes.io/part-of: readarr
diff --git a/kubernetes/apps/media/readarr/app/kustomization.yaml b/kubernetes/apps/media/readarr/app/kustomization.yaml
index 46ef31006..d718b664c 100644
--- a/kubernetes/apps/media/readarr/app/kustomization.yaml
+++ b/kubernetes/apps/media/readarr/app/kustomization.yaml
@@ -5,7 +5,3 @@ namespace: media
 resources:
   - ./audiobooks
   - ./ebooks
-labels:
-  - pairs:
-      app.kubernetes.io/name: readarr
-      app.kubernetes.io/instance: readarr
diff --git a/kubernetes/apps/media/readarr/ks.yaml b/kubernetes/apps/media/readarr/ks.yaml
index 1160b972b..e6fe3bcb1 100644
--- a/kubernetes/apps/media/readarr/ks.yaml
+++ b/kubernetes/apps/media/readarr/ks.yaml
@@ -2,10 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-readarr
+  name: &appname readarr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
+    - name: cluster-apps-volsync
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-cloudnative-pg-cluster
     - name: cluster-apps-external-secrets-stores
@@ -18,3 +23,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: readarr.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/recyclarr/app/helmrelease.yaml b/kubernetes/apps/media/recyclarr/app/helmrelease.yaml
index 7f8176544..121768927 100644
--- a/kubernetes/apps/media/recyclarr/app/helmrelease.yaml
+++ b/kubernetes/apps/media/recyclarr/app/helmrelease.yaml
@@ -50,7 +50,7 @@ spec:
     persistence:
       config:
         enabled: true
-        existingClaim: recyclarr-config
+        existingClaim: "${VOLSYNC_CLAIM}"
       config-file:
         type: configMap
         name: recyclarr-configmap
diff --git a/kubernetes/apps/media/recyclarr/app/kustomization.yaml b/kubernetes/apps/media/recyclarr/app/kustomization.yaml
index eff24856f..a256709a4 100644
--- a/kubernetes/apps/media/recyclarr/app/kustomization.yaml
+++ b/kubernetes/apps/media/recyclarr/app/kustomization.yaml
@@ -3,17 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: media
 resources:
-  - ./pvc.yaml
+  - ./volsync.yaml
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ./volsync.yaml
 configMapGenerator:
   - name: recyclarr-configmap
     files:
       - ./configs/recyclarr.yml
 generatorOptions:
   disableNameSuffixHash: true
-labels:
-  - pairs:
-      app.kubernetes.io/name: recyclarr
-      app.kubernetes.io/instance: recyclarr
diff --git a/kubernetes/apps/media/recyclarr/app/pvc.yaml b/kubernetes/apps/media/recyclarr/app/pvc.yaml
deleted file mode 100644
index dd2738ed7..000000000
--- a/kubernetes/apps/media/recyclarr/app/pvc.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: recyclarr-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
diff --git a/kubernetes/apps/media/recyclarr/app/volsync.yaml b/kubernetes/apps/media/recyclarr/app/volsync.yaml
index 0f4dbd50c..dd1b7d2aa 100644
--- a/kubernetes/apps/media/recyclarr/app/volsync.yaml
+++ b/kubernetes/apps/media/recyclarr/app/volsync.yaml
@@ -3,7 +3,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: recyclarr-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -22,22 +21,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: recyclarr
-  namespace: media
 spec:
-  sourcePVC: recyclarr-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: recyclarr-rdst
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: recyclarr-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: recyclarr-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 2Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: recyclarr-rsrc
+spec:
+  sourcePVC: recyclarr
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: recyclarr-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
diff --git a/kubernetes/apps/media/recyclarr/ks.yaml b/kubernetes/apps/media/recyclarr/ks.yaml
index 94cc81e1b..bb171aa6d 100644
--- a/kubernetes/apps/media/recyclarr/ks.yaml
+++ b/kubernetes/apps/media/recyclarr/ks.yaml
@@ -2,15 +2,19 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-recyclarr
+  name: &appname recyclarr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
-    - name: cluster-apps-sonarr
-    - name: cluster-apps-radarr
     - name: cluster-apps-volsync
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-external-secrets-stores
+    - name: sonarr
+    - name: radarr
   path: ./kubernetes/apps/media/recyclarr/app
   prune: true
   sourceRef:
@@ -20,3 +24,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: recyclarr.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/sabnzbd/app/helmrelease.yaml b/kubernetes/apps/media/sabnzbd/app/helmrelease.yaml
index ee271cf7f..9305e9270 100644
--- a/kubernetes/apps/media/sabnzbd/app/helmrelease.yaml
+++ b/kubernetes/apps/media/sabnzbd/app/helmrelease.yaml
@@ -83,7 +83,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:download
         hosts:
-          - host: &host usenet.${PRIVATE_DOMAIN}
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -91,11 +91,11 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
     persistence:
       config:
         enabled: true
-        existingClaim: sabnzbd-config
+        existingClaim: "${VOLSYNC_CLAIM}"
       media-data:
         type: nfs
         server: nas.${PRIVATE_DOMAIN}
diff --git a/kubernetes/apps/media/sabnzbd/app/kustomization.yaml b/kubernetes/apps/media/sabnzbd/app/kustomization.yaml
index 575ff93fd..358c9a027 100644
--- a/kubernetes/apps/media/sabnzbd/app/kustomization.yaml
+++ b/kubernetes/apps/media/sabnzbd/app/kustomization.yaml
@@ -3,11 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: media
 resources:
-  - ./pvc.yaml
+  - ./volsync.yaml
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ./volsync.yaml
-labels:
-  - pairs:
-      app.kubernetes.io/name: sabnzbd
-      app.kubernetes.io/instance: sabnzbd
diff --git a/kubernetes/apps/media/sabnzbd/app/pvc.yaml b/kubernetes/apps/media/sabnzbd/app/pvc.yaml
deleted file mode 100644
index 6c49a7438..000000000
--- a/kubernetes/apps/media/sabnzbd/app/pvc.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sabnzbd-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
diff --git a/kubernetes/apps/media/sabnzbd/app/volsync.yaml b/kubernetes/apps/media/sabnzbd/app/volsync.yaml
index 8ede70450..dc10fa8dd 100644
--- a/kubernetes/apps/media/sabnzbd/app/volsync.yaml
+++ b/kubernetes/apps/media/sabnzbd/app/volsync.yaml
@@ -3,7 +3,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: sabnzbd-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -22,22 +21,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: sabnzbd
-  namespace: media
 spec:
-  sourcePVC: sabnzbd-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: sabnzbd-rdst
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: sabnzbd-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: sabnzbd-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 2Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: sabnzbd-rsrc
+spec:
+  sourcePVC: sabnzbd
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: sabnzbd-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
diff --git a/kubernetes/apps/media/sabnzbd/ks.yaml b/kubernetes/apps/media/sabnzbd/ks.yaml
index 27f4975d4..40de9e056 100644
--- a/kubernetes/apps/media/sabnzbd/ks.yaml
+++ b/kubernetes/apps/media/sabnzbd/ks.yaml
@@ -2,12 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-sabnzbd
+  name: &appname sabnzbd
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
     - name: cluster-apps-volsync
-    - name: cluster-apps-pvc-media-data
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/sabnzbd/app
@@ -19,3 +22,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: sabnzbd.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/sonarr/app/volsync.yaml b/kubernetes/apps/media/sonarr/app/volsync.yaml
index 8e73c31b8..14e5538a4 100644
--- a/kubernetes/apps/media/sonarr/app/volsync.yaml
+++ b/kubernetes/apps/media/sonarr/app/volsync.yaml
@@ -24,7 +24,7 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: sonarr-config
+  name: sonarr
 spec:
   accessModes: ["ReadWriteOnce"]
   dataSourceRef:
diff --git a/kubernetes/apps/media/sonarr/ks.yaml b/kubernetes/apps/media/sonarr/ks.yaml
index bfafcb943..fff9209bc 100644
--- a/kubernetes/apps/media/sonarr/ks.yaml
+++ b/kubernetes/apps/media/sonarr/ks.yaml
@@ -10,7 +10,7 @@ spec:
     labels:
       app.kubernetes.io/name: *appname
   dependsOn:
-    - name: cluster-apps-pvc-media-data
+    - name: cluster-apps-volsync
     - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/sonarr/app
@@ -19,11 +19,13 @@ spec:
     kind: GitRepository
     name: k8s-gitops
   wait: true
-  interval: 10m
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
   postBuild:
     substitute:
       APP: *appname
       HOSTNAME: sonarr.${PRIVATE_DOMAIN}
       APP_UID: "568"
       APP_GID: "568"
-      VOLSYNC_CLAIM: sonarr-config
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/unpackerr/app/kustomization.yaml b/kubernetes/apps/media/unpackerr/app/kustomization.yaml
index 472e6cc48..8315e8380 100644
--- a/kubernetes/apps/media/unpackerr/app/kustomization.yaml
+++ b/kubernetes/apps/media/unpackerr/app/kustomization.yaml
@@ -5,7 +5,3 @@ namespace: media
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml
-labels:
-  - pairs:
-      app.kubernetes.io/name: unpackerr
-      app.kubernetes.io/instance: unpackerr
diff --git a/kubernetes/apps/media/unpackerr/ks.yaml b/kubernetes/apps/media/unpackerr/ks.yaml
index f51602cfd..00500f77f 100644
--- a/kubernetes/apps/media/unpackerr/ks.yaml
+++ b/kubernetes/apps/media/unpackerr/ks.yaml
@@ -2,13 +2,16 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-unpackerr
+  name: &appname unpackerr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
-    - name: cluster-apps-sonarr
-    - name: cluster-apps-radarr
-    - name: cluster-apps-pvc-media-data
+    - name: cluster-apps-volsync
+    - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/unpackerr/app
   prune: true
@@ -19,3 +22,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: unpackerr.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/wizarr/app/helmrelease.yaml b/kubernetes/apps/media/wizarr/app/helmrelease.yaml
index 7409233b0..418132185 100644
--- a/kubernetes/apps/media/wizarr/app/helmrelease.yaml
+++ b/kubernetes/apps/media/wizarr/app/helmrelease.yaml
@@ -54,7 +54,7 @@ spec:
         annotations:
           hajimari.io/icon: mdi:invite
         hosts:
-          - host: &host invite.${PRIVATE_DOMAIN}
+          - host: "${HOSTNAME}"
             paths:
               - path: /
                 service:
@@ -62,11 +62,11 @@ spec:
                   port: http
         tls:
           - hosts:
-              - *host
+              - "${HOSTNAME}"
     persistence:
       config:
         enabled: true
-        existingClaim: wizarr-config
+        existingClaim: "${VOLSYNC_CLAIM}"
         globalMounts:
           - path: /data/database
     service:
diff --git a/kubernetes/apps/media/wizarr/app/kustomization.yaml b/kubernetes/apps/media/wizarr/app/kustomization.yaml
index 0b209498f..fe6b401ef 100644
--- a/kubernetes/apps/media/wizarr/app/kustomization.yaml
+++ b/kubernetes/apps/media/wizarr/app/kustomization.yaml
@@ -3,10 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: media
 resources:
-  - ./pvc.yaml
-  - ./helmrelease.yaml
   - ./volsync.yaml
-labels:
-  - pairs:
-      app.kubernetes.io/name: wizarr
-      app.kubernetes.io/instance: wizarr
+  - ./helmrelease.yaml
diff --git a/kubernetes/apps/media/wizarr/app/pvc.yaml b/kubernetes/apps/media/wizarr/app/pvc.yaml
deleted file mode 100644
index a93337246..000000000
--- a/kubernetes/apps/media/wizarr/app/pvc.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: wizarr-config
-  namespace: media
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi
-  storageClassName: ${CLUSTER_STORAGE_BLOCK}
diff --git a/kubernetes/apps/media/wizarr/app/volsync.yaml b/kubernetes/apps/media/wizarr/app/volsync.yaml
index 936465376..346b2eae2 100644
--- a/kubernetes/apps/media/wizarr/app/volsync.yaml
+++ b/kubernetes/apps/media/wizarr/app/volsync.yaml
@@ -3,7 +3,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: wizarr-restic
-  namespace: media
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -22,22 +21,60 @@ spec:
     - extract:
         key: volsync-restic-template
 ---
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: wizarr
-  namespace: media
 spec:
-  sourcePVC: wizarr-config
+  accessModes: ["ReadWriteOnce"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: wizarr-rdst
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: ${CLUSTER_STORAGE_BLOCK}
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: wizarr-rdst
+spec:
   trigger:
-    schedule: "0 8 * * *"
+    manual: restore-once
   restic:
+    repository: wizarr-restic-secret
     copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
+    cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
+    moverSecurityContext:
+      runAsUser: 568
+      runAsGroup: 568
+      fsGroup: 568
+    capacity: 2Gi # must match the PersistentVolumeClaim `.resources.requests.storage` size above
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: wizarr-rsrc
+spec:
+  sourcePVC: wizarr
+  trigger:
+    schedule: "15 */8 * * *"
+  restic:
     pruneIntervalDays: 10
     repository: wizarr-restic-secret
-    cacheCapacity: 8Gi
-    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    copyMethod: Snapshot
+    accessModes: ["ReadWriteOnce"]
     storageClassName: ${CLUSTER_STORAGE_BLOCK}
+    volumeSnapshotClassName: ${CLUSTER_SNAPSHOT_BLOCK}
+    cacheAccessModes: ["ReadWriteOnce"]
+    cacheCapacity: 8Gi
     cacheStorageClassName: ${CLUSTER_STORAGE_HOSTPATH}
     moverSecurityContext:
       runAsUser: 568
diff --git a/kubernetes/apps/media/wizarr/ks.yaml b/kubernetes/apps/media/wizarr/ks.yaml
index af9e1dfa0..d0698e70e 100644
--- a/kubernetes/apps/media/wizarr/ks.yaml
+++ b/kubernetes/apps/media/wizarr/ks.yaml
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-wizarr
+  name: &appname wizarr
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
     - name: cluster-apps-volsync
     - name: cluster-apps-rook-ceph-cluster
@@ -18,3 +22,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: invites.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname
diff --git a/kubernetes/apps/media/ytdl-sub/app/helmrelease.yaml b/kubernetes/apps/media/ytdl-sub/app/helmrelease.yaml
index 1312778e8..b4179f0c7 100644
--- a/kubernetes/apps/media/ytdl-sub/app/helmrelease.yaml
+++ b/kubernetes/apps/media/ytdl-sub/app/helmrelease.yaml
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: &app ytdl-sub
+  name: ytdl-sub
   namespace: media
 spec:
   interval: 30m
diff --git a/kubernetes/apps/media/ytdl-sub/app/kustomization.yaml b/kubernetes/apps/media/ytdl-sub/app/kustomization.yaml
index 3e9f0cdb6..7c490a233 100644
--- a/kubernetes/apps/media/ytdl-sub/app/kustomization.yaml
+++ b/kubernetes/apps/media/ytdl-sub/app/kustomization.yaml
@@ -5,7 +5,3 @@ namespace: media
 resources:
   - ./configs/config.yaml
   - ./helmrelease.yaml
-labels:
-  - pairs:
-      app.kubernetes.io/name: ytdl-sub
-      app.kubernetes.io/instance: ytdl-sub
diff --git a/kubernetes/apps/media/ytdl-sub/ks.yaml b/kubernetes/apps/media/ytdl-sub/ks.yaml
index e6cf95ebb..653d10720 100644
--- a/kubernetes/apps/media/ytdl-sub/ks.yaml
+++ b/kubernetes/apps/media/ytdl-sub/ks.yaml
@@ -2,11 +2,16 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-ytdl-sub
+  name: &appname ytdl-sub
   namespace: flux-system
 spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
   dependsOn:
-    - name: cluster-apps-cloudnative-pg-cluster
+    - name: cluster-apps-volsync
+    - name: cluster-apps-rook-ceph-cluster
     - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/media/ytdl-sub/app
   prune: true
@@ -17,3 +22,10 @@ spec:
   interval: 30m
   retryInterval: 1m
   timeout: 5m
+  postBuild:
+    substitute:
+      APP: *appname
+      HOSTNAME: ytdl-sub.${PRIVATE_DOMAIN}
+      APP_UID: "568"
+      APP_GID: "568"
+      VOLSYNC_CLAIM: *appname