diff --git a/nodes/heimdall/sonarr/compose.yaml b/nodes/heimdall/sonarr/compose.yaml
index e6774d0..f276024 100644
--- a/nodes/heimdall/sonarr/compose.yaml
+++ b/nodes/heimdall/sonarr/compose.yaml
@@ -27,10 +27,30 @@ services:
     restart: unless-stopped
     networks:
       - proxy-net
+    # labels:
+    #   - "traefik.enable=true"
+    #   - "traefik.http.routers.sonarr.entrypoints=websecure"
+    #   - "traefik.http.routers.sonarr.rule=Host(`sonarr.castaldifamily.com`)"
+    #   - "traefik.http.routers.sonarr.tls=true"
+    #   - "traefik.http.routers.sonarr.tls.certresolver=cloudflare"
+    #   - "traefik.http.services.sonarr.loadbalancer.server.port=8989"
+
+  sonarr_outpost:
+    image: ghcr.io/goauthentik/proxy
+    # Optionally specify the container's network, which must be able to reach the core authentik server.
+    networks:
+      - proxy-net
+    container_name: sonarr_outpost
+    environment:
+        AUTHENTIK_HOST: https://sso.castaldifamily.com
+        AUTHENTIK_INSECURE: "false"
+        AUTHENTIK_TOKEN: cJ4UWeFQ2DUTyvR22s588ciFuLSw698HTVxnEf7ecN3dq3nFOyVod6ngE66Z
+        # Optional setting to be used when `authentik_host` for internal communication doesn't match the public URL.
+        AUTHENTIK_HOST_BROWSER: https://sonarr.castaldifamily.com
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.sonarr.entrypoints=websecure"
       - "traefik.http.routers.sonarr.rule=Host(`sonarr.castaldifamily.com`)"
       - "traefik.http.routers.sonarr.tls=true"
       - "traefik.http.routers.sonarr.tls.certresolver=cloudflare"
-      - "traefik.http.services.sonarr.loadbalancer.server.port=8989" # Internal port for Sonarr
+      - "traefik.http.services.sonarr.loadbalancer.server.port=9000"
\ No newline at end of file