diff --git a/tofu/authentik/main.tf b/tofu/authentik/main.tf
index ead5247..68f9f44 100644
--- a/tofu/authentik/main.tf
+++ b/tofu/authentik/main.tf
@@ -27,6 +27,11 @@ resource "authentik_group" "admins" {
   is_superuser = true
 }
 
+resource "authentik_group" "arrs" {
+  name         = "arrs"
+  is_superuser = false
+}
+
 resource "authentik_group" "vpn" {
   name         = "vpn"
   is_superuser = false
@@ -116,7 +121,7 @@ module "sonarr" {
   source                       = "../modules/authentik-proxy"
   app_name                     = "Sonarr"
   app_slug                     = "sonarr"
-  app_access_group_id          = authentik_group.admins.id
+  app_access_group_id          = authentik_group.arrs.id
   app_url                      = "https://sonarr.fukurokuju.dev"
   internal_host                = "http://192.168.1.3:38013/"
   internal_host_ssl_validation = false
@@ -127,7 +132,7 @@ module "radarr" {
   source                       = "../modules/authentik-proxy"
   app_name                     = "Radarr"
   app_slug                     = "radarr"
-  app_access_group_id          = authentik_group.admins.id
+  app_access_group_id          = authentik_group.arrs.id
   app_url                      = "https://radarr.fukurokuju.dev"
   internal_host                = "http://192.168.1.3:38012/"
   internal_host_ssl_validation = false
@@ -138,7 +143,7 @@ module "lidarr" {
   source                       = "../modules/authentik-proxy"
   app_name                     = "Lidarr"
   app_slug                     = "lidarr"
-  app_access_group_id          = authentik_group.admins.id
+  app_access_group_id          = authentik_group.arrs.id
   app_url                      = "https://lidarr.fukurokuju.dev"
   internal_host                = "http://192.168.1.3:38010/"
   internal_host_ssl_validation = false
@@ -149,7 +154,7 @@ module "qbit" {
   source                       = "../modules/authentik-proxy"
   app_name                     = "qBit"
   app_slug                     = "qbit"
-  app_access_group_id          = authentik_group.admins.id
+  app_access_group_id          = authentik_group.arrs.id
   app_url                      = "https://qbit.fukurokuju.dev"
   internal_host                = "http://192.168.1.3:30024"
   internal_host_ssl_validation = false