diff --git a/cluster/apps/download/network_policy.yaml b/cluster/apps/download/network_policy.yaml
index 4c34cf5..ea2a397 100644
--- a/cluster/apps/download/network_policy.yaml
+++ b/cluster/apps/download/network_policy.yaml
@@ -19,6 +19,10 @@ spec:
         matchLabels:
           name: "traefik"
 
+    - namespaceSelector:
+        matchLabels:
+          needsDownload: "yes"
+
     # Allow all pods with this label
     - podSelector:
         matchLabels:
diff --git a/cluster/apps/media/jellyfin/helm-release.yaml b/cluster/apps/media/jellyfin/helm-release.yaml
index ed5eae8..a67c623 100644
--- a/cluster/apps/media/jellyfin/helm-release.yaml
+++ b/cluster/apps/media/jellyfin/helm-release.yaml
@@ -15,15 +15,13 @@ spec:
         namespace: flux-system
 
   values:
-    # Set a global label value
-    global:
-      labels:
-        needsAuthentik: "yes"
-
     image:
       repository: jellyfin/jellyfin
       tag: latest
 
+    podLabels:
+      needsAuthentik: "yes"
+
     service:
       main:
         ports:
diff --git a/cluster/apps/media/jellyseerr/helm-release.yaml b/cluster/apps/media/jellyseerr/helm-release.yaml
index c400b5b..0467fce 100644
--- a/cluster/apps/media/jellyseerr/helm-release.yaml
+++ b/cluster/apps/media/jellyseerr/helm-release.yaml
@@ -19,6 +19,9 @@ spec:
       repository: fallenbagel/jellyseerr
       tag: develop
 
+    podLabels:
+      needsDownload: "yes"
+
     env:
       TZ: America/New_York