diff --git a/hosts/sisko/default.nix b/hosts/sisko/default.nix
index b67b313..e5d6e87 100644
--- a/hosts/sisko/default.nix
+++ b/hosts/sisko/default.nix
@@ -31,6 +31,7 @@
       "paperless"
       "syncthing"
       "atticd"
+      "jellyfin"
     ]
     ++ [
       ./disko.nix
diff --git a/modules/cloudflare-dyndns/default.nix b/modules/cloudflare-dyndns/default.nix
index e86c6b6..9aaab39 100644
--- a/modules/cloudflare-dyndns/default.nix
+++ b/modules/cloudflare-dyndns/default.nix
@@ -14,8 +14,7 @@
       "vpn.aciceri.dev"
       "photos.aciceri.dev"
       "status.aciceri.dev"
-      "paper.aciceri.dev"
-      "cloud.aciceri.dev"
+      "jelly.aciceri.dev"
     ];
     apiTokenFile = config.age.secrets.cloudflare-dyndns-api-token.path;
   };
diff --git a/modules/jellyfin/default.nix b/modules/jellyfin/default.nix
index 33e1cd1..51e066a 100644
--- a/modules/jellyfin/default.nix
+++ b/modules/jellyfin/default.nix
@@ -1,7 +1,21 @@
+{ config, ... }:
 {
   services.jellyfin = {
     enable = true;
+    openFirewall = true;
   };
 
   users.users.jellyfin.extraGroups = [ "transmission" ];
+
+  environment.persistence."/persist".directories = [
+    config.services.jellyfin.dataDir
+  ];
+
+  services.nginx.virtualHosts = {
+    "jelly.aciceri.dev" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/".proxyPass = "http://127.0.0.1:8096";
+    };
+  };
 }