diff --git a/flake.lock b/flake.lock
index f935b29..29bf465 100644
--- a/flake.lock
+++ b/flake.lock
@@ -281,11 +281,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1725983898,
-        "narHash": "sha256-4b3A9zPpxAxLnkF9MawJNHDtOOl6ruL0r6Og1TEDGCE=",
+        "lastModified": 1726062873,
+        "narHash": "sha256-IiA3jfbR7K/B5+9byVi9BZGWTD4VSbWe8VLpp9B/iYk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1355a0cbfeac61d785b7183c0caaec1f97361b43",
+        "rev": "4f807e8940284ad7925ebd0a0993d2a1791acb2f",
         "type": "github"
       },
       "original": {
@@ -381,7 +381,7 @@
         "dirtyRev": "c5b9c2a8084c913d8ae75c36f9d548f2777d0b42-dirty",
         "dirtyShortRev": "c5b9c2a-dirty",
         "lastModified": 1726097959,
-        "narHash": "sha256-o3nETR9jLJN/qWqDhOIhf+CqGkEBRGSywmVo4Ai5wDI=",
+        "narHash": "sha256-kdESoz3wOmRxcSCFC7JttpR75s+2mEoK4nSW2LZxt5o=",
         "type": "git",
         "url": "file:./secrets"
       },
diff --git a/hosts/Hevana/default.nix b/hosts/Hevana/default.nix
index 5f50be2..3ccea64 100644
--- a/hosts/Hevana/default.nix
+++ b/hosts/Hevana/default.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   # Do not change this value! This tracks when NixOS was installed on your system.
@@ -64,6 +69,9 @@ in
     };
   };
 
+  # Disable NetworkManager
+  networking.networkmanager.enable = lib.mkForce false;
+
   # Configure the system.
   aux.system = {
     # Enable to allow unfree (e.g. closed source) packages.
@@ -129,7 +137,7 @@ in
         home = "${services-root}/forgejo";
         url = config.secrets.services.forgejo.url;
         actions = {
-          enable = true;
+          enable = false;
           token = config.secrets.services.forgejo.runner-token;
         };
       };
@@ -185,6 +193,11 @@ in
         enable = true;
         home = "${services-root}/qbittorrent";
         url = config.secrets.services.qbittorrent.url;
+        port = "8090";
+        vpn = {
+          enable = true;
+          privateKey = config.secrets.services.protonvpn.privateKey;
+        };
       };
       ssh = {
         enable = true;
diff --git a/modules/services/qbittorrent.nix b/modules/services/qbittorrent.nix
index 81eb3ea..06f49dc 100644
--- a/modules/services/qbittorrent.nix
+++ b/modules/services/qbittorrent.nix
@@ -10,7 +10,6 @@ let
   UID = 850;
   GID = 850;
   package = pkgs.qbittorrent-nox;
-  port = "8090";
 in
 {
   options = {
@@ -27,6 +26,11 @@ in
         description = "The complete URL where qBittorrent is hosted.";
         example = "https://qbittorrent.example.com";
       };
+      port = lib.mkOption {
+        type = lib.types.str;
+        default = "8080";
+        description = "The port to host qBittorrent on.";
+      };
       user = lib.mkOption {
         type = lib.types.str;
         default = "qbittorrent";
@@ -37,8 +41,14 @@ in
         default = "qbittorrent";
         description = "Group under which qBittorrent runs.";
       };
+      vpn = {
+        enable = lib.mkEnableOption "Enables a VPN.";
+        privateKey = lib.mkOption {
+          type = lib.types.str;
+          description = "Wireguard private key.";
+        };
+      };
     };
-
   };
 
   config = lib.mkIf cfg.enable {
@@ -47,7 +57,7 @@ in
         useACMEHost = pkgs.util.getDomainFromURL cfg.url;
         forceSSL = true;
         locations."/" = {
-          proxyPass = "http://127.0.0.1:${port}";
+          proxyPass = "http://127.0.0.1:${cfg.port}";
           extraConfig = ''
             proxy_set_header   X-Real-IP $remote_addr;
             proxy_set_header   X-Forwarded-Host $host;
@@ -58,41 +68,41 @@ in
       };
     };
 
-    systemd.services.qbittorrent = {
-      # based on the plex.nix service module and
-      # https://github.com/qbittorrent/qBittorrent/blob/master/dist/unix/systemd/qbittorrent-nox%40.service.in
-      description = "qBittorrent service";
-      documentation = [ "man:qbittorrent-nox(1)" ];
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      unitConfig.RequiresMountsFor = cfg.home;
+    virtualisation = {
+      podman.autoPrune.enable = true;
+      oci-containers.containers = {
+        qbittorrent = {
+          image = "lscr.io/linuxserver/qbittorrent:latest";
+          environment = {
+            PUID = (builtins.toString UID);
+            PGID = (builtins.toString GID);
+            WEBUI_PORT = "${cfg.port}";
+          };
+          volumes = [
+            "${cfg.home}:/config"
+            "${cfg.home}/qBittorrent/downloads:/downloads"
+          ];
+          # Forward ports to gluetun if VPN is enabled. Otherwise, open ports directly
+          extraOptions = lib.mkIf cfg.vpn.enable [ "--network=container:gluetun" ];
+          dependsOn = lib.mkIf cfg.vpn.enable [ "gluetun" ];
+          ports = lib.mkIf (!cfg.vpn.enable) [ "${cfg.port}:${cfg.port}" ];
+        };
 
-      serviceConfig = {
-        Type = "simple";
-        User = cfg.user;
-        Group = cfg.group;
-
-        # Run the pre-start script with full permissions (the "!" prefix) so it
-        # can create the data directory if necessary.
-        ExecStartPre =
-          let
-            preStartScript = pkgs.writeScript "qbittorrent-run-prestart" ''
-              #!${pkgs.bash}/bin/bash
-
-              # Create data directory if it doesn't exist
-              if ! test -d "$QBT_PROFILE"; then
-                echo "Creating initial qBittorrent data directory in: $QBT_PROFILE"
-                install -d -m 0755 -o "${cfg.user}" -g "${cfg.group}" "$QBT_PROFILE"
-              fi
-            '';
-          in
-          "!${preStartScript}";
-        ExecStart = "${package}/bin/qbittorrent-nox";
-      };
-
-      environment = {
-        QBT_PROFILE = cfg.home;
-        QBT_WEBUI_PORT = port;
+        gluetun = lib.mkIf cfg.vpn.enable {
+          image = "qmcgaw/gluetun:latest";
+          extraOptions = [
+            "--cap-add=NET_ADMIN"
+            "--device=/dev/net/tun"
+          ];
+          environment = {
+            VPN_SERVICE_PROVIDER = "protonvpn";
+            VPN_TYPE = "wireguard";
+            WIREGUARD_PRIVATE_KEY = config.secrets.services.protonvpn.privateKey;
+            SERVER_COUNTRIES = "Netherlands";
+            TZ = "America/New_York";
+          };
+          ports = [ "${cfg.port}:${cfg.port}" ];
+        };
       };
     };
 
@@ -106,6 +116,6 @@ in
       groups.${cfg.group}.gid = GID;
     };
 
-    systemd.services.nginx.wants = [ config.systemd.services.qbittorrent.name ];
+    systemd.services.nginx.wants = [ config.systemd.services.podman-qbittorrent.name ];
   };
 }
diff --git a/secrets b/secrets
index 2fc0eb4..98c890d 160000
--- a/secrets
+++ b/secrets
@@ -1 +1 @@
-Subproject commit 2fc0eb462b4f2333ac0d9eb9cb2405e05afe66f7
+Subproject commit 98c890dfd160353f4f1b2490263edf3deeb43a27