diff --git a/services/jellyfin/deployment.yaml b/services/jellyfin/deployment.yaml
index 8ffc2494..cae0c02d 100644
--- a/services/jellyfin/deployment.yaml
+++ b/services/jellyfin/deployment.yaml
@@ -33,7 +33,7 @@ spec:
       # Clean up any lingering OIDC artifacts and strip the injected script tag
       initContainers:
         - name: strip-oidc
-          image: docker.io/jellyfin/jellyfin:10.11.5
+          image: docker.io/jellyfin/jellyfin:10.11.5@sha256:6d819e9ab067efcf712993b23455cc100ee5585919bb297ea5a109ac00cb626e
           securityContext:
             runAsUser: 0
             runAsGroup: 0
@@ -58,7 +58,7 @@ spec:
         # Force all users to authenticate via the LDAP plugin provider by updating the DB on start.
         # This keeps Flux enforcement for auth provider drift (e.g., after UI edits).
         - name: set-ldap-auth-provider
-          image: docker.io/library/alpine:3.20
+          image: docker.io/library/alpine:3.20@sha256:765942a4039992336de8dd5db680586e1a206607dd06170ff0a37267a9e01958
           securityContext:
             runAsUser: 0
             runAsGroup: 0
@@ -77,34 +77,16 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: longhorn-host
-                    operator: In
-                    values:
-                      - "true"
-                  - key: node-role.kubernetes.io/worker
-                    operator: In
-                    values:
-                      - "true"
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                  - key: hardware
-                    operator: In
-                    values:
-                      - rpi5
-            - weight: 80
-              preference:
-                matchExpressions:
-                  - key: kubernetes.io/hostname
-                    operator: In
-                    values:
-                      - titan-24
+      nodeSelector:
+        kubernetes.io/hostname: titan-22
+      priorityClassName: media-core
+      runtimeClassName: nvidia
+      terminationGracePeriodSeconds: 60
+      tolerations:
+        - key: atlas.bstein.dev/media-primary
+          operator: Equal
+          value: "true"
+          effect: PreferNoSchedule
       securityContext:
         runAsUser: 1000 
         fsGroup: 65532
@@ -112,7 +94,7 @@ spec:
         runAsGroup: 65532
       containers:
         - name: jellyfin
-          image: docker.io/jellyfin/jellyfin:10.11.5
+          image: docker.io/jellyfin/jellyfin:10.11.5@sha256:6d819e9ab067efcf712993b23455cc100ee5585919bb297ea5a109ac00cb626e
           imagePullPolicy: IfNotPresent
           command:
             - /entrypoint.sh
@@ -121,6 +103,27 @@ spec:
           ports:
             - name: http
               containerPort: 8096
+          startupProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 2
+            failureThreshold: 60
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 2
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 15
+            timeoutSeconds: 2
+            failureThreshold: 4
           env:
             - name: JELLYFIN_PublishedServerUrl
               value: "https://stream.bstein.dev"
@@ -130,15 +133,21 @@ spec:
               value: "65532"
             - name: UMASK
               value: "002"
+            - name: NVIDIA_DRIVER_CAPABILITIES
+              value: compute,video,utility
             - name: VAULT_COPY_FILES
               value: /vault/secrets/ldap-config.xml:/config/plugins/configurations/LDAP-Auth.xml
           resources:
             requests:
-              cpu: "500m"
-              memory: 1Gi
+              cpu: "2"
+              memory: 2Gi
+              ephemeral-storage: 8Gi
+              nvidia.com/gpu.shared: "1"
             limits:
-              cpu: "1500m"
-              memory: 3Gi
+              cpu: "8"
+              memory: 8Gi
+              ephemeral-storage: 80Gi
+              nvidia.com/gpu.shared: "1"
           volumeMounts:
             - name: jellyfin-vault-entrypoint
               mountPath: /entrypoint.sh
@@ -178,7 +187,8 @@ spec:
           persistentVolumeClaim:
             claimName: jellyfin-config-astreae
         - name: cache
-          emptyDir: {}
+          emptyDir:
+            sizeLimit: 64Gi
         - name: media
           persistentVolumeClaim:
             claimName: jellyfin-media-asteria-new