diff --git a/apps/qbittorrent/deployment.yaml b/apps/qbittorrent/deployment.yaml
index f566e76..bcaee5b 100644
--- a/apps/qbittorrent/deployment.yaml
+++ b/apps/qbittorrent/deployment.yaml
@@ -39,6 +39,27 @@ spec:
         - name: qbittorrent
           image: ghcr.io/hotio/qbittorrent:release
           imagePullPolicy: Always
+          # Hotio automatically permits the Pod's directly attached /24 but
+          # rejects that same subnet in VPN_LAN_NETWORK. Add every *other* /24
+          # from this cluster's 10.244.0.0/21 Pod range at runtime so traffic
+          # from ingress-nginx and media apps works regardless of scheduling.
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              own_octet="${POD_IP#10.244.}"
+              own_octet="${own_octet%%.*}"
+              case "$own_octet" in
+                0|1|2|3|4|5|6|7) ;;
+                *) echo "Unexpected Pod IP: $POD_IP" >&2; exit 1 ;;
+              esac
+              for octet in 0 1 2 3 4 5 6 7; do
+                if [ "$octet" != "$own_octet" ]; then
+                  VPN_LAN_NETWORK="${VPN_LAN_NETWORK},10.244.${octet}.0/24"
+                fi
+              done
+              export VPN_LAN_NETWORK
+              exec /init
           securityContext:
             # Hotio needs this capability to create the WireGuard interface,
             # routes, firewall rules, and VPN kill switch inside the Pod.
@@ -46,6 +67,10 @@ spec:
               add:
                 - NET_ADMIN
           env:
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
             - name: PUID
               value: "1000"
             - name: PGID
@@ -82,10 +107,14 @@ spec:
             - name: http
               containerPort: 8080
               protocol: TCP
+          # Proton must negotiate a forwarded port before qBittorrent starts
+          # its Web UI, so avoid expected connection-refused events during that
+          # normal initialization window.
           startupProbe:
             httpGet:
               path: /
               port: http
+            initialDelaySeconds: 30
             periodSeconds: 5
             timeoutSeconds: 3
             failureThreshold: 36