diff --git a/hieradata/virtual/lxc.yaml b/hieradata/virtual/lxc.yaml
index f2d7929..98c12d9 100644
--- a/hieradata/virtual/lxc.yaml
+++ b/hieradata/virtual/lxc.yaml
@@ -5,3 +5,12 @@ profiles::packages::include:
 
 # disable mlock for vault nodes on lxd/incus
 vault::disable_mlock: true
+
+hiera_exclude:
+  # exclude the media profiles which are just cephfs-mount-management
+  - profiles::media::lidar
+  - profiles::media::nzbget
+  - profiles::media::prowlarr
+  - profiles::media::radarr
+  - profiles::media::readarr
+  - profiles::media::sonarr
diff --git a/site/profiles/manifests/media/jellyfin.pp b/site/profiles/manifests/media/jellyfin.pp
index 4943a1c..c4e0525 100644
--- a/site/profiles/manifests/media/jellyfin.pp
+++ b/site/profiles/manifests/media/jellyfin.pp
@@ -13,30 +13,32 @@ class profiles::media::jellyfin (
   Boolean              $migrate_data   = true,
 ) {
 
-  include profiles::ceph::client
+  if $facts['virtual'] == 'lxc' {
+    include profiles::ceph::client
 
-  # manage the sharedvol
-  profiles::storage::cephfsvol {"${::facts['networking']['fqdn']}_media":
-    mount       => $media_root,
-    keyring     => '/etc/ceph/ceph.client.media.keyring',
-    cephfs_name => 'media',
-    cephfs_fs   => 'mediafs',
-    require     => Profiles::Ceph::Keyring['media'],
-  }
+    # manage the sharedvol
+    profiles::storage::cephfsvol {"${::facts['networking']['fqdn']}_media":
+      mount       => $media_root,
+      keyring     => '/etc/ceph/ceph.client.media.keyring',
+      cephfs_name => 'media',
+      cephfs_fs   => 'mediafs',
+      require     => Profiles::Ceph::Keyring['media'],
+    }
 
-  # export haproxy balancemember
-  profiles::haproxy::balancemember { "${facts['networking']['fqdn']}_443":
-    service => 'be_jellyfin',
-    ports   => [443],
-    options => [
-      "cookie ${facts['networking']['hostname']}",
-      'ssl',
-      'verify none',
-      'check',
-      'inter 2s',
-      'rise 3',
-      'fall 2',
-    ]
+    # export haproxy balancemember
+    profiles::haproxy::balancemember { "${facts['networking']['fqdn']}_443":
+      service => 'be_jellyfin',
+      ports   => [443],
+      options => [
+        "cookie ${facts['networking']['hostname']}",
+        'ssl',
+        'verify none',
+        'check',
+        'inter 2s',
+        'rise 3',
+        'fall 2',
+      ]
+    }
   }
 
   mkdir::p {[$data_dir, $lib_dir, $cache_dir, $config_dir, $log_dir]:}