diff --git a/apps/base/arrstack/prowlarr/deployment.yaml b/apps/base/arrstack/prowlarr/deployment.yaml
index 4e79607..0987f90 100644
--- a/apps/base/arrstack/prowlarr/deployment.yaml
+++ b/apps/base/arrstack/prowlarr/deployment.yaml
@@ -26,7 +26,10 @@ spec:
         # (override bootstrap): the key is minted in Vault, synced by VSO into the
         # prowlarr-apikey Secret, and written here. UrlBase=/prowlarr lets arrproxy
         # forward arrstack.unkin.net/prowlarr/... with the prefix preserved (no 307).
-        # Runs as root to fix ownership; touches only <ApiKey> and <UrlBase>.
+        # Runs as root to fix ownership; touches only <ApiKey>, <UrlBase>, and
+        # <AuthenticationMethod>=External + <AuthenticationRequired>. External makes
+        # the *arr defer UI login to arrproxy/oauth2-proxy (same no-auth request
+        # handler as None, but permits remote access without prompting).
         - name: apikey-init
           image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
           imagePullPolicy: IfNotPresent
@@ -50,9 +53,11 @@ spec:
                   ;;
               esac
               URL_BASE=/prowlarr
+              AUTH_METHOD=External
+              AUTH_REQUIRED=Enabled
               CFG=/config/config.xml
               if [ ! -f "$CFG" ]; then
-                printf '<Config>\n  <ApiKey>%s</ApiKey>\n  <UrlBase>%s</UrlBase>\n</Config>\n' "$API_KEY" "$URL_BASE" > "$CFG"
+                printf '<Config>\n  <ApiKey>%s</ApiKey>\n  <UrlBase>%s</UrlBase>\n  <AuthenticationMethod>%s</AuthenticationMethod>\n  <AuthenticationRequired>%s</AuthenticationRequired>\n</Config>\n' "$API_KEY" "$URL_BASE" "$AUTH_METHOD" "$AUTH_REQUIRED" > "$CFG"
               else
                 if grep -q '<ApiKey>' "$CFG"; then
                   sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
@@ -64,10 +69,20 @@ spec:
                 else
                   sed -i "s|<Config>|<Config>\n  <UrlBase>${URL_BASE}</UrlBase>|" "$CFG"
                 fi
+                if grep -q '<AuthenticationMethod>' "$CFG"; then
+                  sed -i "s|<AuthenticationMethod>[^<]*</AuthenticationMethod>|<AuthenticationMethod>${AUTH_METHOD}</AuthenticationMethod>|" "$CFG"
+                else
+                  sed -i "s|<Config>|<Config>\n  <AuthenticationMethod>${AUTH_METHOD}</AuthenticationMethod>|" "$CFG"
+                fi
+                if grep -q '<AuthenticationRequired>' "$CFG"; then
+                  sed -i "s|<AuthenticationRequired>[^<]*</AuthenticationRequired>|<AuthenticationRequired>${AUTH_REQUIRED}</AuthenticationRequired>|" "$CFG"
+                else
+                  sed -i "s|<Config>|<Config>\n  <AuthenticationRequired>${AUTH_REQUIRED}</AuthenticationRequired>|" "$CFG"
+                fi
               fi
               chown 1000:1000 "$CFG"
               chmod 600 "$CFG"
-              echo "config-init: <ApiKey> and <UrlBase>=${URL_BASE} enforced from Vault"
+              echo "config-init: <ApiKey>, <UrlBase>=${URL_BASE}, <AuthenticationMethod>=${AUTH_METHOD}, <AuthenticationRequired>=${AUTH_REQUIRED} enforced from Vault"
           resources:
             requests:
               cpu: 50m
diff --git a/apps/base/arrstack/radarr/deployment.yaml b/apps/base/arrstack/radarr/deployment.yaml
index 7a09cf1..47bd03a 100644
--- a/apps/base/arrstack/radarr/deployment.yaml
+++ b/apps/base/arrstack/radarr/deployment.yaml
@@ -26,7 +26,10 @@ spec:
         # (override bootstrap): the key is minted in Vault, synced by VSO into the
         # radarr-apikey Secret, and written here. UrlBase=/radarr lets arrproxy
         # forward arrstack.unkin.net/radarr/... with the prefix preserved (no 307).
-        # Runs as root to fix ownership; touches only <ApiKey> and <UrlBase>.
+        # Runs as root to fix ownership; touches only <ApiKey>, <UrlBase>, and
+        # <AuthenticationMethod>=External + <AuthenticationRequired>. External makes
+        # the *arr defer UI login to arrproxy/oauth2-proxy (same no-auth request
+        # handler as None, but permits remote access without prompting).
         - name: apikey-init
           image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
           imagePullPolicy: IfNotPresent
@@ -50,9 +53,11 @@ spec:
                   ;;
               esac
               URL_BASE=/radarr
+              AUTH_METHOD=External
+              AUTH_REQUIRED=Enabled
               CFG=/config/config.xml
               if [ ! -f "$CFG" ]; then
-                printf '<Config>\n  <ApiKey>%s</ApiKey>\n  <UrlBase>%s</UrlBase>\n</Config>\n' "$API_KEY" "$URL_BASE" > "$CFG"
+                printf '<Config>\n  <ApiKey>%s</ApiKey>\n  <UrlBase>%s</UrlBase>\n  <AuthenticationMethod>%s</AuthenticationMethod>\n  <AuthenticationRequired>%s</AuthenticationRequired>\n</Config>\n' "$API_KEY" "$URL_BASE" "$AUTH_METHOD" "$AUTH_REQUIRED" > "$CFG"
               else
                 if grep -q '<ApiKey>' "$CFG"; then
                   sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
@@ -64,10 +69,20 @@ spec:
                 else
                   sed -i "s|<Config>|<Config>\n  <UrlBase>${URL_BASE}</UrlBase>|" "$CFG"
                 fi
+                if grep -q '<AuthenticationMethod>' "$CFG"; then
+                  sed -i "s|<AuthenticationMethod>[^<]*</AuthenticationMethod>|<AuthenticationMethod>${AUTH_METHOD}</AuthenticationMethod>|" "$CFG"
+                else
+                  sed -i "s|<Config>|<Config>\n  <AuthenticationMethod>${AUTH_METHOD}</AuthenticationMethod>|" "$CFG"
+                fi
+                if grep -q '<AuthenticationRequired>' "$CFG"; then
+                  sed -i "s|<AuthenticationRequired>[^<]*</AuthenticationRequired>|<AuthenticationRequired>${AUTH_REQUIRED}</AuthenticationRequired>|" "$CFG"
+                else
+                  sed -i "s|<Config>|<Config>\n  <AuthenticationRequired>${AUTH_REQUIRED}</AuthenticationRequired>|" "$CFG"
+                fi
               fi
               chown 1000:1000 "$CFG"
               chmod 600 "$CFG"
-              echo "config-init: <ApiKey> and <UrlBase>=${URL_BASE} enforced from Vault"
+              echo "config-init: <ApiKey>, <UrlBase>=${URL_BASE}, <AuthenticationMethod>=${AUTH_METHOD}, <AuthenticationRequired>=${AUTH_REQUIRED} enforced from Vault"
           resources:
             requests:
               cpu: 50m
diff --git a/apps/base/arrstack/sonarr/deployment.yaml b/apps/base/arrstack/sonarr/deployment.yaml
index 230208a..9ce95a6 100644
--- a/apps/base/arrstack/sonarr/deployment.yaml
+++ b/apps/base/arrstack/sonarr/deployment.yaml
@@ -29,7 +29,10 @@ spec:
         # (override bootstrap): the key is minted in Vault, synced by VSO into the
         # sonarr-apikey Secret, and written here. UrlBase=/sonarr lets arrproxy
         # forward arrstack.unkin.net/sonarr/... with the prefix preserved (no 307).
-        # Runs as root to fix ownership; touches only <ApiKey> and <UrlBase>.
+        # Runs as root to fix ownership; touches only <ApiKey>, <UrlBase>, and
+        # <AuthenticationMethod>=External + <AuthenticationRequired>. External makes
+        # the *arr defer UI login to arrproxy/oauth2-proxy (same no-auth request
+        # handler as None, but permits remote access without prompting).
         - name: apikey-init
           image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
           imagePullPolicy: IfNotPresent
@@ -53,9 +56,11 @@ spec:
                   ;;
               esac
               URL_BASE=/sonarr
+              AUTH_METHOD=External
+              AUTH_REQUIRED=Enabled
               CFG=/config/config.xml
               if [ ! -f "$CFG" ]; then
-                printf '<Config>\n  <ApiKey>%s</ApiKey>\n  <UrlBase>%s</UrlBase>\n</Config>\n' "$API_KEY" "$URL_BASE" > "$CFG"
+                printf '<Config>\n  <ApiKey>%s</ApiKey>\n  <UrlBase>%s</UrlBase>\n  <AuthenticationMethod>%s</AuthenticationMethod>\n  <AuthenticationRequired>%s</AuthenticationRequired>\n</Config>\n' "$API_KEY" "$URL_BASE" "$AUTH_METHOD" "$AUTH_REQUIRED" > "$CFG"
               else
                 if grep -q '<ApiKey>' "$CFG"; then
                   sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
@@ -67,10 +72,20 @@ spec:
                 else
                   sed -i "s|<Config>|<Config>\n  <UrlBase>${URL_BASE}</UrlBase>|" "$CFG"
                 fi
+                if grep -q '<AuthenticationMethod>' "$CFG"; then
+                  sed -i "s|<AuthenticationMethod>[^<]*</AuthenticationMethod>|<AuthenticationMethod>${AUTH_METHOD}</AuthenticationMethod>|" "$CFG"
+                else
+                  sed -i "s|<Config>|<Config>\n  <AuthenticationMethod>${AUTH_METHOD}</AuthenticationMethod>|" "$CFG"
+                fi
+                if grep -q '<AuthenticationRequired>' "$CFG"; then
+                  sed -i "s|<AuthenticationRequired>[^<]*</AuthenticationRequired>|<AuthenticationRequired>${AUTH_REQUIRED}</AuthenticationRequired>|" "$CFG"
+                else
+                  sed -i "s|<Config>|<Config>\n  <AuthenticationRequired>${AUTH_REQUIRED}</AuthenticationRequired>|" "$CFG"
+                fi
               fi
               chown 1000:1000 "$CFG"
               chmod 600 "$CFG"
-              echo "config-init: <ApiKey> and <UrlBase>=${URL_BASE} enforced from Vault"
+              echo "config-init: <ApiKey>, <UrlBase>=${URL_BASE}, <AuthenticationMethod>=${AUTH_METHOD}, <AuthenticationRequired>=${AUTH_REQUIRED} enforced from Vault"
           resources:
             requests:
               cpu: 50m