diff --git a/nodes/heimdall/sabnzbd/compose.yaml b/nodes/heimdall/sabnzbd/compose.yaml
index 95d807a..3f5e80c 100644
--- a/nodes/heimdall/sabnzbd/compose.yaml
+++ b/nodes/heimdall/sabnzbd/compose.yaml
@@ -28,9 +28,25 @@ services:
     restart: unless-stopped
     networks:
       - proxy-net
+    # labels:
+    #   - "traefik.enable=true"
+    #   - "traefik.http.routers.sabnzbd.rule=Host(`sab.castaldifamily.com`)"
+    #   - "traefik.http.routers.sabnzbd.entrypoints=websecure"
+    #   - "traefik.http.routers.sabnzbd.tls.certresolver=letsencrypt"
+    #   - "traefik.http.services.sabnzbd.loadbalancer.server.port=8080"
+  sabnzbd_outpost:
+    image: ghcr.io/goauthentik/proxy:2026.2.2
+    container_name: sabnzbd_outpost
+    networks:
+      - proxy-net
+    environment:
+      AUTHENTIK_HOST: https://sso.castaldifamily.com
+      AUTHENTIK_TOKEN: 42FCcV9gmTfixaak77xW4eAZIMUUJ0u5vGsxvumfo1Lav5DIyLViDz4xqinE
+      AUTHENTIK_INSECURE: "false"
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.sabnzbd.rule=Host(`sab.castaldifamily.com`)"
-      - "traefik.http.routers.sabnzbd.entrypoints=websecure"
-      - "traefik.http.routers.sabnzbd.tls.certresolver=letsencrypt"
-      - "traefik.http.services.sabnzbd.loadbalancer.server.port=8080"
\ No newline at end of file
+      - "traefik.http.routers.sabnzbd-proxy.entrypoints=websecure"
+      - "traefik.http.routers.sabnzbd-proxy.rule=Host(`sabnzbd.castaldifamily.com`)"
+      - "traefik.http.routers.sabnzbd-proxy.tls=true"
+      - "traefik.http.routers.sabnzbd-proxy.tls.certresolver=cloudflare"
+      - "traefik.http.services.sabnzbd-proxy.loadbalancer.server.port=9000"
\ No newline at end of file