diff --git a/homelab/server/config/autopirate/docker-compose.yml b/homelab/server/config/autopirate/docker-compose.yml
index e304a17d..29b81fba 100644
--- a/homelab/server/config/autopirate/docker-compose.yml
+++ b/homelab/server/config/autopirate/docker-compose.yml
@@ -24,7 +24,7 @@ services:
       - traefik.http.routers.radarr.rule=Host(`radarr.jafner.net`)
       - traefik.http.routers.radarr.tls.certresolver=lets-encrypt
       - traefik.http.services.radarr.loadbalancer.server.port=7878
-      - traefik.http.routers.radarr.middlewares=authentik@file
+      - traefik.http.routers.radarr.middlewares=authentik@file,lan-only@file
       - traefik.http.routers.radarr.priority=10
       - traefik.http.routers.radarr-auth.rule=Host(`radarr.jafner.net`) && PathPrefix(`/outpost.goauthentik.io/`)
       - traefik.http.routers.radarr-auth.priority=15
@@ -55,7 +55,7 @@ services:
       - traefik.http.routers.sonarr.rule=Host(`sonarr.jafner.net`)
       - traefik.http.routers.sonarr.tls.certresolver=lets-encrypt
       - traefik.http.services.sonarr.loadbalancer.server.port=8989
-      - traefik.http.routers.sonarr.middlewares=authentik@file
+      - traefik.http.routers.sonarr.middlewares=authentik@file,lan-only@file
       - traefik.http.routers.sonarr.priority=10
       - traefik.http.routers.sonarr-auth.rule=Host(`sonarr.jafner.net`) && PathPrefix(`/outpost.goauthentik.io/`)
       - traefik.http.routers.sonarr-auth.priority=15
@@ -85,7 +85,7 @@ services:
       - traefik.http.routers.lidarr.rule=Host(`lidarr.jafner.net`)
       - traefik.http.routers.lidarr.tls.certresolver=lets-encrypt
       - trarfik.http.services.lidarr.loadbalancer.server.port=8686
-      - traefik.http.routers.lidarr.middlewares=authentik@file
+      - traefik.http.routers.lidarr.middlewares=authentik@file,lan-only@file
       - traefik.http.routers.lidarr.priority=10
       - traefik.http.routers.lidarr-auth.rule=Host(`lidarr.jafner.net`) && PathPrefix(`/outpost.goauthentik.io/`)
       - traefik.http.routers.lidarr-auth.priority=15
@@ -114,7 +114,7 @@ services:
       - traefik.http.routers.nzbhydra2.rule=Host(`nzbhydra.jafner.net`)
       - traefik.http.routers.nzbhydra2.tls.certresolver=lets-encrypt
       - traefik.http.services.nzbhydra2.loadbalancer.server.port=5076
-      - traefik.http.routers.nzbhydra2.middlewares=authentik@file
+      - traefik.http.routers.nzbhydra2.middlewares=authentik@file,lan-only@file
       - traefik.http.routers.nzbhydra2.priority=10
       - traefik.http.routers.nzbhydra2-auth.rule=Host(`nzbhydra.jafner.net`) && PathPrefix(`/outpost.goauthentik.io/`)
       - traefik.http.routers.nzbhydra2-auth.priority=15
@@ -147,7 +147,7 @@ services:
       - traefik.http.routers.sabnzbd.rule=Host(`sabnzbd.jafner.net`)
       - traefik.http.routers.sabnzbd.tls.certresolver=lets-encrypt
       - traefik.http.services.sabnzbd.loadbalancer.server.port=8080
-      - traefik.http.routers.sabnzbd.middlewares=authentik@file
+      - traefik.http.routers.sabnzbd.middlewares=authentik@file,lan-only@file
       - traefik.http.routers.sabnzbd.priority=10
       - traefik.http.routers.sabnzbd-auth.rule=Host(`sabnzbd.jafner.net`) && PathPrefix(`/outpost.goauthentik.io/`)
       - traefik.http.routers.sabnzbd-auth.priority=15
@@ -174,7 +174,7 @@ services:
     labels:
       - traefik.http.routers.tdarr.rule=Host(`tdarr.jafner.net`)
       - traefik.http.routers.tdarr.tls.certresolver=lets-encrypt
-      - traefik.http.routers.tdarr.middlewares=authentik@file
+      - traefik.http.routers.tdarr.middlewares=authentik@file,lan-only@file
       - traefik.http.services.tdarr.loadbalancer.server.port=8265
       - traefik.http.routers.tdarr.priority=10
       - traefik.http.routers.tdarr-auth.rule=Host(`tdarr.jafner.net`) && PathPrefix(`/outpost.goauthentik.io/`)
@@ -261,7 +261,7 @@ services:
       - traefik.http.routers.jackett.rule=Host(`jackett.jafner.net`)
       - traefik.http.routers.jackett.tls.certresolver=lets-encrypt
       - traefik.http.services.jackett.loadbalancer.server.port=9117
-      - traefik.http.routers.jackett.middlewares=authentik@file
+      - traefik.http.routers.jackett.middlewares=authentik@file,lan-only@file
       - traefik.http.routers.jackett.priority=10
       - traefik.http.routers.jackett-auth.rule=Host(`jackett.jafner.net`) && PathPrefix(`/outpost.goauthentik.io/`)
       - traefik.http.routers.jackett-auth.priority=15