diff --git a/roles/mediaserver/defaults/main.yml b/roles/mediaserver/defaults/main.yml
index f48f9e2..70fcf46 100644
--- a/roles/mediaserver/defaults/main.yml
+++ b/roles/mediaserver/defaults/main.yml
@@ -4,6 +4,7 @@ containers:
     image: ghcr.io/onedr0p/radarr
     port: 7878
     volumes:
+      - /data/state/radarr/config.xml:/config/config.xml
       - /data/radarr.db:/config/radarr.db
       - /data/radarr.db-wal:/config/radarr.db-wal
       - /cache/radarr:/config/MediaCover
@@ -13,6 +14,7 @@ containers:
     image: ghcr.io/onedr0p/sonarr
     port: 8989
     volumes:
+      - /data/state/sonarr/config.xml:/config/config.xml
       - /data/sonarr.db:/config/sonarr.db
       - /data/sonarr.db-wal:/config/sonarr.db-wal
       - /cache/sonarr:/config/MediaCover
@@ -22,6 +24,7 @@ containers:
     image: ghcr.io/onedr0p/prowlarr
     port: 9696
     volumes:
+      - /data/state/prowlarr/config.xml:/config/config.xml
       - /data/prowlarr.db:/config/prowlarr.db
       - /data/prowlarr.db-wal:/config/prowlarr.db-wal
 
diff --git a/roles/mediaserver/tasks/arr.yml b/roles/mediaserver/tasks/arr.yml
new file mode 100644
index 0000000..0d4f37e
--- /dev/null
+++ b/roles/mediaserver/tasks/arr.yml
@@ -0,0 +1,48 @@
+---
+- name: Create {{ item.key }} config directory
+  become: true
+  ansible.builtin.file:
+    path: /data/state/{{ item.key }}
+    state: directory
+    mode: 0755
+    owner: "{{ nonroot_uid }}"
+    group: "{{ nonroot_gid }}"
+
+- name: Check if config file exists for {{ item.key }}
+  ansible.builtin.stat:
+    path: /data/state/{{ item.key }}/config.xml
+  register: config_file
+
+- name: Create config file for {{ item.key }}
+  ansible.builtin.copy:
+    dest: /data/state/{{ item.key }}/config.xml
+    content: "<Config/>"
+    mode: 0600
+  when: not config_file.stat.exists
+  notify: Restart {{ item.key }}
+
+- name: Configure {{ item.key }}
+  community.general.xml:
+    path: /data/state/{{ item.key }}/config.xml
+    xpath: /Config/{{ param.key }}
+    value: "{{ param.value }}"
+  loop:
+    - key: LogLevel
+      value: debug
+    - key: Port
+      value: "{{ item.value.port }}"
+    - key: UrlBase
+      value: "{{ item.key }}"
+    - key: ApiKey
+      value: "{{ secrets.api_keys[item.key] }}"
+    - key: AnalyticsEnabled
+      value: "false"
+    - key: AuthenticationMethod
+      value: External
+    - key: AuthenticationRequired
+      value: DisabledForLocalAddresses
+    - key: LaunchBrowser
+      value: "false"
+  loop_control:
+    loop_var: param
+  notify: Restart {{ item.key }}
diff --git a/roles/mediaserver/tasks/main.yml b/roles/mediaserver/tasks/main.yml
index 98ffe6d..7f166b8 100644
--- a/roles/mediaserver/tasks/main.yml
+++ b/roles/mediaserver/tasks/main.yml
@@ -6,6 +6,7 @@
       | combine({
         'version': item.value.version | default(default.version),
         'container_volumes': item.value.volumes | default([]),
+        'container_env': item.value.env | default({}),
       })
     }) }}"
   with_dict: "{{ containers }}"
@@ -18,12 +19,6 @@
       | combine({
         'container_image': item.value.image + ':' + item.value.version,
         'container_port': '127.0.0.1:' + item.value.port | string + ':' + item.value.port | string,
-        'container_env': item.value.env | default({}) | combine({
-          item.key | upper + '__API_KEY': secrets.api_keys[item.key],
-          item.key | upper + '__LOG_LEVEL': 'debug',
-          item.key | upper + '__URL_BASE': item.key,
-          item.key | upper + '__ANALYTICS_ENABLED': 'False',
-        } if 'arr' in item.key else {}),
       })
     }) }}"
   with_dict: "{{ containers }}"
@@ -103,6 +98,13 @@
 - name: Configure jellyfin
   ansible.builtin.include_tasks: jellyfin.yml
 
+- name: Configure arr services
+  ansible.builtin.include_tasks: arr.yml
+  with_dict: "{{ containers }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: item.key.endswith("arr")
+
 - name: Create and configure containers
   ansible.builtin.include_role:
     name: mhutter.docker-systemd-service