diff --git a/hosts/jupiter/configuration.nix b/hosts/jupiter/configuration.nix
index f78db1c..186c436 100644
--- a/hosts/jupiter/configuration.nix
+++ b/hosts/jupiter/configuration.nix
@@ -13,6 +13,7 @@
     ../../services/containers.nix
     ../../services/caddy.nix
     ../../services/tailscale.nix
+    ../../services/jellyfin.nix
   ];
 
   # ---- Host identity ----
@@ -52,6 +53,7 @@
   services.caddy.virtualHosts = {
     "http://localhost".extraConfig = "reverse_proxy localhost:8080";
     "http://audiobookshelf.jupiter.sol".extraConfig = "reverse_proxy localhost:8000";
+    "http://jellyfin.jupiter.sol".extraConfig = "reverse_proxy localhost:8096";
   };
 
   system.stateVersion = "26.05";
diff --git a/services/jellyfin.nix b/services/jellyfin.nix
new file mode 100644
index 0000000..a018bd0
--- /dev/null
+++ b/services/jellyfin.nix
@@ -0,0 +1,16 @@
+{ ... }:
+
+# Audiobookshelf audiobook/podcast server.
+# Listens on all interfaces: :8000 stays closed on the LAN (no openFirewall),
+# but reachable over the trusted tailscale0 interface and via localhost (caddy).
+# Library/media paths are set in the web UI — point them at /mnt/data/...
+# Runs as user `audiobookshelf`; added to `users` so it can read group-owned
+# library dirs on the RAID.
+{
+  services.jellyfin = {
+    enable = true;
+    dataDir = "/mnt/data/AppData/jellyfin";
+    cacheDir = "${cfg.dataDir}/cache";
+  };
+  users.users.jellyfin.extraGroups = [ "users" ];
+}