diff --git a/apps/bazarr.yaml b/apps/bazarr.yaml
new file mode 100644
index 0000000..2cba26d
--- /dev/null
+++ b/apps/bazarr.yaml
@@ -0,0 +1,26 @@
+# This ArgoCD application deploys bazarr to manage subtitles for the media library
+# This application pulls its image from hotio as they're generally light weight.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: bazarr
+  namespace: argocd
+  # skipping resources-finalizer.argocd.argoproj.io as it as bazaarr will create its configs
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/bazarr
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: bazarr
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/apps/bazarr/deployment.yaml b/apps/bazarr/deployment.yaml
new file mode 100644
index 0000000..de6fe6d
--- /dev/null
+++ b/apps/bazarr/deployment.yaml
@@ -0,0 +1,56 @@
+# bazarr image from hotio ghcr.io/hotio/bazarr
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bazarr
+  namespace: bazarr
+spec:
+  # not critical infrastructure a single pod should be sufficient
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: bazarr
+  template:
+    metadata:
+      labels:
+        app: bazarr
+    spec:
+      containers:
+        - name: bazarr
+          image: ghcr.io/hotio/bazarr:release
+          imagePullPolicy: Always
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: UMASK
+              value: "002"
+            - name: TZ
+              value: "Europe/London"
+          ports:
+            - name: http
+              containerPort: 6767
+              protocol: TCP
+          volumeMounts:
+            - name: bazarr-config
+              mountPath: /config
+            - name: cryo-media
+              mountPath: /movies
+              subPath: Movies
+            - name: cryo-media
+              mountPath: /tv
+              subPath: TVShows
+            - name: cryo-media
+              mountPath: /anime
+              subPath: Anime
+      volumes:
+        - name: bazarr-config
+          persistentVolumeClaim:
+            claimName: bazarr-data
+        - name: cryo-media
+          nfs:
+            server: nas.ahmza.com
+            path: /srv/media
diff --git a/apps/bazarr/ingress.yaml b/apps/bazarr/ingress.yaml
new file mode 100644
index 0000000..31b4cc0
--- /dev/null
+++ b/apps/bazarr/ingress.yaml
@@ -0,0 +1,25 @@
+# routes for bazarr.ahmza.com through ingress-nginx (docs/11-ingress.md)
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: bazarr
+  namespace: bazarr
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+spec:
+  tls:
+    - hosts:
+      - bazarr.ahmza.com
+      # cert-manager keeps this up to date. nothing to do by hand
+      secretName: bazarr-tls
+  rules:
+    - host: bazarr.ahmza.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: bazarr
+                port:
+                  number: 6767
diff --git a/apps/bazarr/namespace.yaml b/apps/bazarr/namespace.yaml
new file mode 100644
index 0000000..eb18a3a
--- /dev/null
+++ b/apps/bazarr/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: bazarr
diff --git a/apps/bazarr/pvc.yaml b/apps/bazarr/pvc.yaml
new file mode 100644
index 0000000..c194830
--- /dev/null
+++ b/apps/bazarr/pvc.yaml
@@ -0,0 +1,12 @@
+# create a longhorn pvc for bazarr's config (see docs/06-longhorn.md)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: bazarr-data
+  namespace: bazarr
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
diff --git a/apps/bazarr/service.yaml b/apps/bazarr/service.yaml
new file mode 100644
index 0000000..53bf94d
--- /dev/null
+++ b/apps/bazarr/service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: bazarr
+  namespace: bazarr
+spec:
+  selector:
+    app: bazarr
+  ports:
+    - name: http
+      port: 6767
+      targetPort: http
diff --git a/apps/seerr.yaml b/apps/seerr.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/apps/seerr/Chart.yaml b/apps/seerr/Chart.yaml
new file mode 100644
index 0000000..3f1a3b4
--- /dev/null
+++ b/apps/seerr/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+name: seerr-app
+description: Deploys Seerr using its official upstream helm chart
+type: application
+version: 0.1.0
+
+dependencies:
+  - name: seerr-chart
+    alias: seerr
+    version: "3.9.0"
+    repository: oci://ghcr.io/seerr-team/seerr
diff --git a/apps/seerr/values.yaml b/apps/seerr/values.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/docs/network.md b/docs/network.md
index fd88ca2..edc8c26 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -67,7 +67,7 @@ Every real DNS record pointing at ingress-nginx's shared address
 | Hostname | App | Namespace | TLS | Source |
 |---|---|---|---|---|
 | `demo.ahmza.com` | Demo app | `demo` | Yes — `letsencrypt-prod`, real trusted cert (see [`docs/12-cert-manager.md`](12-cert-manager.md)) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) |
-| `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Staging requested — promote to `letsencrypt-prod` after the staging Certificate is verified Ready | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) |
+| `mc.ahmza.com` | Packwiz modpack files | `mcpacks` | Yes — `letsencrypt-prod`, real trusted certificate | [`apps/mcpacks/ingress.yaml`](../apps/mcpacks/ingress.yaml) |
 
 Add a row here every time you point a new hostname at this cluster (see
 [`docs/11-ingress.md`](11-ingress.md)). The DNS record itself lives in