diff --git a/machines/storage/s0/default.nix b/machines/storage/s0/default.nix
index 4426676..7b8c877 100644
--- a/machines/storage/s0/default.nix
+++ b/machines/storage/s0/default.nix
@@ -75,6 +75,32 @@
     services.lidarr.enable = true;
     services.lidarr.user = "public_data";
     services.lidarr.group = "public_data";
+    services.recyclarr = {
+      enable = true;
+      configuration = {
+        radarr.radarr_main = {
+          api_key = {
+            _secret = "/run/credentials/recyclarr.service/radarr-api-key";
+          };
+          base_url = "http://localhost:7878";
+
+          quality_definition.type = "movie";
+        };
+        sonarr.sonarr_main = {
+          api_key = {
+            _secret = "/run/credentials/recyclarr.service/sonarr-api-key";
+          };
+          base_url = "http://localhost:8989";
+
+          quality_definition.type = "series";
+        };
+      };
+    };
+
+    systemd.services.recyclarr.serviceConfig.LoadCredential = [
+      "radarr-api-key:/run/agenix/radarr-api-key"
+      "sonarr-api-key:/run/agenix/sonarr-api-key"
+    ];
 
     services.transmission = {
       enable = true;
@@ -145,6 +171,8 @@
     8686 # lidarr
     9091 # transmission web
   ];
+  age.secrets.radarr-api-key.file = ../../../secrets/radarr-api-key.age;
+  age.secrets.sonarr-api-key.file = ../../../secrets/sonarr-api-key.age;
 
   # jellyfin
   # jellyfin cannot run in the vpn container and use hardware encoding
diff --git a/machines/storage/s0/properties.nix b/machines/storage/s0/properties.nix
index 4b77af6..c177035 100644
--- a/machines/storage/s0/properties.nix
+++ b/machines/storage/s0/properties.nix
@@ -14,6 +14,7 @@
     "gitea-actions-runner"
     "frigate"
     "zigbee"
+    "media-server"
   ];
 
   hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";
diff --git a/secrets/radarr-api-key.age b/secrets/radarr-api-key.age
new file mode 100644
index 0000000..9c2cec4
Binary files /dev/null and b/secrets/radarr-api-key.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index e4de178..edc06be 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -60,4 +60,8 @@ with roles;
 
   # zigbee2mqtt secrets
   "zigbee2mqtt.yaml.age".publicKeys = zigbee;
+
+  # Sonarr and Radarr secrets
+  "radarr-api-key.age".publicKeys = media-server;
+  "sonarr-api-key.age".publicKeys = media-server;
 }
diff --git a/secrets/sonarr-api-key.age b/secrets/sonarr-api-key.age
new file mode 100644
index 0000000..6bde867
--- /dev/null
+++ b/secrets/sonarr-api-key.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw NkdwenOkJJKKoezAE1jG20cxwOFk2DVsbMoTaw6ce0M
+8sV6ZJupuSaktW2MaAWg0BqtX1j5I0R3Oq1wFKoXP0M
+-> ssh-ed25519 w3nu8g vJ7zMw2Ruh50ufkxrttuhXT2E3c8bvZnvp0xpkCGhTo
+xpQOVyGwQhoAi/79ZISCxAvnNiRwMbgQ42H5V0zQe10
+--- 57doMaI074hj/Ko2mWqFHcqEPRR24C7U1QbDOCPIOKI
+�(D���ĭ�Q�2��vz�w�*����aO��N/1Gij�e��z�Q(�mgd�y�p���P
+
+�a�C�8�
\ No newline at end of file