diff --git a/apps/base/arrstack/kustomization.yaml b/apps/base/arrstack/kustomization.yaml
index d676b39..a3846b7 100644
--- a/apps/base/arrstack/kustomization.yaml
+++ b/apps/base/arrstack/kustomization.yaml
@@ -7,8 +7,10 @@ resources:
   - vaultauth.yaml
   - pv-media-tv.yaml
   - pv-media-movies.yaml
+  - pv-mediafs.yaml
   - pvc-media-tv.yaml
   - pvc-media-movies.yaml
+  - pvc-mediafs.yaml
   - media-bucket.yaml
   - backups-bucket.yaml
   - postgres
diff --git a/apps/base/arrstack/pv-mediafs.yaml b/apps/base/arrstack/pv-mediafs.yaml
new file mode 100644
index 0000000..66e604a
--- /dev/null
+++ b/apps/base/arrstack/pv-mediafs.yaml
@@ -0,0 +1,31 @@
+---
+# Static PV exposing the legacy mediafs CephFS filesystem root for the upcoming
+# mediamover tool. clusterID only selects the monitor set from the csi config;
+# fsName selects the actual filesystem, so the ssd_ec clusterID still reaches
+# mediafs on the same cluster. Staged with the dedicated ceph-mediafs client.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: arrstack-mediafs
+spec:
+  capacity:
+    storage: 10Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  volumeMode: Filesystem
+  claimRef:
+    namespace: arrstack
+    name: mediafs
+  csi:
+    driver: cephfs.csi.ceph.com
+    volumeHandle: arrstack-mediafs-static
+    nodeStageSecretRef:
+      name: ceph-mediafs-secret
+      namespace: csi-cephfs
+    volumeAttributes:
+      staticVolume: "true"
+      clusterID: cephfs_csi_ssd_ec_4_1
+      fsName: mediafs
+      rootPath: /
diff --git a/apps/base/arrstack/pvc-mediafs.yaml b/apps/base/arrstack/pvc-mediafs.yaml
new file mode 100644
index 0000000..5dd6feb
--- /dev/null
+++ b/apps/base/arrstack/pvc-mediafs.yaml
@@ -0,0 +1,20 @@
+---
+# Legacy mediafs filesystem root, statically bound to the arrstack-mediafs PV
+# for the upcoming mediamover tool. storageClassName "" + volumeName disables
+# dynamic provisioning and binds the pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mediafs
+  namespace: arrstack
+  annotations:
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: arrstack-mediafs
+  volumeMode: Filesystem
diff --git a/apps/base/csi-cephfs/kustomization.yaml b/apps/base/csi-cephfs/kustomization.yaml
index cd444d8..b3854cc 100644
--- a/apps/base/csi-cephfs/kustomization.yaml
+++ b/apps/base/csi-cephfs/kustomization.yaml
@@ -6,5 +6,6 @@ resources:
   - namespace.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vaultstaticsecret-mediafs.yaml
   - storageclass.yaml
   - vmservicescrape.yaml
diff --git a/apps/base/csi-cephfs/vaultstaticsecret-mediafs.yaml b/apps/base/csi-cephfs/vaultstaticsecret-mediafs.yaml
new file mode 100644
index 0000000..7063e62
--- /dev/null
+++ b/apps/base/csi-cephfs/vaultstaticsecret-mediafs.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: ceph-mediafs-secret
+  namespace: csi-cephfs
+spec:
+  vaultAuthRef: ceph-csi-cephfs
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/csi/ceph-mediafs-secret
+  refreshAfter: 5m
+  destination:
+    name: ceph-mediafs-secret
+    create: true