diff --git a/kubernetes/apps/downloads/sabnzbd/app/externalsecret.yaml b/kubernetes/apps/downloads/sabnzbd/app/externalsecret.yaml
new file mode 100644
index 00000000..fa276d6a
--- /dev/null
+++ b/kubernetes/apps/downloads/sabnzbd/app/externalsecret.yaml
@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name radarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        SABNZBD__API_KEY: "{{ .SABNZBD_API_KEY }}"
+        SABNZBD__NZB_KEY: "{{ .SABNZBD_NZB_KEY }}"
+  data:
+    - secretKey: SABNZBD_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
+        property: username
+    - secretKey: SABNZBD_NZB_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
diff --git a/kubernetes/apps/downloads/sabnzbd/app/helmrelease.yaml b/kubernetes/apps/downloads/sabnzbd/app/helmrelease.yaml
new file mode 100644
index 00000000..ad3c8d4a
--- /dev/null
+++ b/kubernetes/apps/downloads/sabnzbd/app/helmrelease.yaml
@@ -0,0 +1,139 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sabnzbd
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  valuesFrom:
+    - kind: ConfigMap
+      name: authelia-ingress-hv
+  values:
+    controllers:
+      sabnzbd:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sabnzbd
+              tag: 4.3.3@sha256:86c645db93affcbf01cc2bce2560082bfde791009e1506dba68269b9c50bc341
+            env:
+              TZ: ${TIMEZONE}
+              SABNZBD__PORT: &port 8080
+              SABNZBD__HOST_WHITELIST_ENTRIES: >-
+                sabnzbd,
+                sabnzbd.downloads,
+                sabnzbd.downloads.svc,
+                sabnzbd.downloads.svc.cluster,
+                sabnzbd.downloads.svc.cluster.local,
+                sabnzbd.${SECRET_DOMAIN}
+            envFrom:
+              - secretRef:
+                  name: *app
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /api?mode=version
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            resources:
+              requests:
+                cpu: 300m
+                memory: 1Gi
+              limits:
+                memory: 4Gi
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}"
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Downloads
+        #   gethomepage.dev/name: SABnzbd
+        #   gethomepage.dev/icon: sabnzbd
+        #   gethomepage.dev/widget.type: sabnzbd
+        #   gethomepage.dev/widget.url: http://sabnzbd.downloads:8080
+        #   gethomepage.dev/widget.key: "{{`{{HOMEPAGE_VAR_SABNZBD_TOKEN}}`}}"
+        #   nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+
+    persistence:
+      config:
+        existingClaim: cifs-appdata
+      tmp:
+        type: emptyDir
+      incomplete:
+        type: emptyDir
+      applications:
+        existingClaim: cifs-appdata
+        globalMounts:
+          - path: /media/applications
+      downloads:
+        existingClaim: cifs-downloads
+        globalMounts:
+          - path: /downloads
+            subPath: sabnzbd
+      # games:
+      #   existingClaim: cifs-games
+      #   globalMounts:
+      #     - path: /media/games
+      # misc:
+      #   existingClaim: cifs-misc
+      #   globalMounts:
+      #     - path: /media/misc
diff --git a/kubernetes/apps/downloads/sabnzbd/app/kustomization.yaml b/kubernetes/apps/downloads/sabnzbd/app/kustomization.yaml
new file mode 100644
index 00000000..ea556565
--- /dev/null
+++ b/kubernetes/apps/downloads/sabnzbd/app/kustomization.yaml
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
diff --git a/kubernetes/apps/downloads/sabnzbd/ks.yaml b/kubernetes/apps/downloads/sabnzbd/ks.yaml
new file mode 100644
index 00000000..ec68c2bf
--- /dev/null
+++ b/kubernetes/apps/downloads/sabnzbd/ks.yaml
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sabnzbd
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: volsync
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/sabnzbd/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app