diff --git a/containers/122-arriman.md b/containers/122-arriman.md
index 7ad2583..69b9936 100644
--- a/containers/122-arriman.md
+++ b/containers/122-arriman.md
@@ -22,19 +22,27 @@ Docker host running the \*arr stack via [`ezarr`](https://github.com/ezarr/ezarr
 
 ## Service / port map
 
+All services route through gluetun's network namespace. Ports are exposed via
+the gluetun container:
+
 | Service       | Host:Container | Public hostname                      |
 | ------------- | -------------- | ------------------------------------ |
-| sonarr        | `8989:8989`    | direct only                          |
-| radarr        | `7878:7878`    | direct only                          |
-| lidarr        | `8686:8686`    | direct only                          |
-| prowlarr      | `9696:9696`    | direct only                          |
-| bazarr        | `6767:6767`    | direct only                          |
+| gluetun (VPN) | —              | —                                    |
+| sonarr        | `8989:8989`    | direct only (via gluetun)            |
+| radarr        | `7878:7878`    | direct only (via gluetun)            |
+| lidarr        | `8686:8686`    | direct only (via gluetun)            |
+| prowlarr      | `9696:9696`    | direct only (via gluetun)            |
+| bazarr        | `6767:6767`    | direct only (via gluetun)            |
 | jellyseerr    | `5056:5055`    | [`jellyseerr.hubris.network`](../infrastructure/dns.md) |
 | qbittorrent   | `8080:8080`    | [`qbit.hubris.network`](../infrastructure/dns.md)       |
-| sabnzbd       | `8081:8080`    | [`sab.hubris.network`](../infrastructure/dns.md)        |
+| sabnzbd       | `8082:8082`    | [`sab.hubris.network`](../infrastructure/dns.md)        |
 | flaresolverr  | `8191:8191`    | internal only                        |
+| homarr        | `7575:7575`    | internal only                        |
 
-Internal *arr ↔ *arr / *arr ↔ qBit/SAB/flaresolverr comms run on `ezarr_default` using docker service names.
+Internal *arr ↔ *arr / *arr ↔ qBit/SAB/flaresolverr comms run on `localhost:<port>`
+(services share gluetun's shared network namespace). External services reach them
+via `gluetun:<port>` (e.g. Sonarr → qBittorrent at `localhost:8080` or
+`gluetun:8080`).
 
 ## Categories (qBit + SAB + *arr)
 
@@ -101,6 +109,19 @@ Member of [media GID 10000](../infrastructure/media-permissions.md). The LXC has
 
 ## Changelog
 
+### 2026-06-04 — all arr services moved behind gluetun VPN; SAB port conflict fixed
+
+- All services (sonarr, radarr, lidarr, bazarr, prowlarr, jellyseerr, homarr,
+  flaresolverr) now use `network_mode: service:gluetun` — whole stack routes
+  through the VPN
+- Port mappings moved from individual services to gluetun container
+- **Fixed SABnzbd port conflict**: was crashing in a restart loop because
+  qBittorrent held port 8080 inside the shared gluetun namespace. Changed
+  SAB internal port to 8082 (config at `/config/sabnzbd-config/sabnzbd.ini`)
+- Caddy `sab.hubris.network` updated to point to `:8082`
+- Jellyseerr's `extra_hosts` (auth.hubris.network) moved to gluetun since
+  `extra_hosts` conflicts with `network_mode`
+
 ### 2026-06-02 — ProtonVPN added (gluetun); LXC IP set static
 - Added `gluetun` container to compose as a WireGuard VPN sidecar (ProtonVPN, server AL#57, located in Tirana, Albania)
 - **qbittorrent** and **sabnzbd** now use `network_mode: service:gluetun` — all traffic routes through the VPN