diff --git a/docker/netbird/docker-compose.yml b/docker/netbird/docker-compose.yml
index 58a46f3..63cb819 100644
--- a/docker/netbird/docker-compose.yml
+++ b/docker/netbird/docker-compose.yml
@@ -23,7 +23,7 @@ services:
         max-size: "500m"
         max-file: "2"
   signal:
-    image: netbirdio/signal:0.36.7
+    image: netbirdio/signal:0.37.1
     restart: unless-stopped
     volumes:
       - netbird-signal:/var/lib/netbird
diff --git a/docker/nextcloud/Dockerfile b/docker/nextcloud/Dockerfile
index 3009267..d088a52 100644
--- a/docker/nextcloud/Dockerfile
+++ b/docker/nextcloud/Dockerfile
@@ -1,4 +1,4 @@
-FROM nextcloud:30.0.6-apache
+FROM nextcloud:31.0.0-apache
 
 RUN set -ex; \
     \
diff --git a/docker/nextcloud/docker-compose.yml b/docker/nextcloud/docker-compose.yml
index bf1033a..8016afd 100644
--- a/docker/nextcloud/docker-compose.yml
+++ b/docker/nextcloud/docker-compose.yml
@@ -14,7 +14,7 @@ services:
       - nextcloud
 
   nextcloud:
-    image: git.roboces.dev/catalin/fukuops:nextcloud-30.0.6
+    image: git.roboces.dev/catalin/fukuops:nextcloud-31.0.0
     volumes:
       - /mnt/nas1/legacy-storage/cloud/cloud/data:/var/www/html/data
       - /mnt/nas1/legacy-storage/cloud/cloud/config:/var/www/html/config
diff --git a/k8s/argo-apps/authentik.yaml b/k8s/argo-apps/authentik.yaml
index 30929f6..23193d7 100644
--- a/k8s/argo-apps/authentik.yaml
+++ b/k8s/argo-apps/authentik.yaml
@@ -12,7 +12,7 @@ spec:
   sources:
     - chart: authentik
       repoURL: https://charts.goauthentik.io/
-      targetRevision: 2024.12.*
+      targetRevision: 2025.2.*
       helm:
         valuesObject:
           authentik:
diff --git a/k8s/argo-apps/elastic.yaml b/k8s/argo-apps/elastic.yaml
index 6fd7b9c..ad10f66 100644
--- a/k8s/argo-apps/elastic.yaml
+++ b/k8s/argo-apps/elastic.yaml
@@ -12,7 +12,7 @@ spec:
   sources:
     - chart: elasticsearch
       repoURL: registry-1.docker.io/bitnamicharts
-      targetRevision: 21.4.6
+      targetRevision: 21.4.7
       helm:
         valuesObject:
           service:
diff --git a/k8s/argo-apps/renovate.yaml b/k8s/argo-apps/renovate.yaml
index 6580bc0..fc11db5 100644
--- a/k8s/argo-apps/renovate.yaml
+++ b/k8s/argo-apps/renovate.yaml
@@ -13,7 +13,7 @@ spec:
   sources:
     - chart: renovate
       repoURL: https://docs.renovatebot.com/helm-charts
-      targetRevision: 39.182.*
+      targetRevision: 39.185.*
       helm:
         valuesObject:
           renovate:
diff --git a/tofu/authentik/main.tf b/tofu/authentik/main.tf
index ead5247..68f9f44 100644
--- a/tofu/authentik/main.tf
+++ b/tofu/authentik/main.tf
@@ -27,6 +27,11 @@ resource "authentik_group" "admins" {
   is_superuser = true
 }
 
+resource "authentik_group" "arrs" {
+  name         = "arrs"
+  is_superuser = false
+}
+
 resource "authentik_group" "vpn" {
   name         = "vpn"
   is_superuser = false
@@ -116,7 +121,7 @@ module "sonarr" {
   source                       = "../modules/authentik-proxy"
   app_name                     = "Sonarr"
   app_slug                     = "sonarr"
-  app_access_group_id          = authentik_group.admins.id
+  app_access_group_id          = authentik_group.arrs.id
   app_url                      = "https://sonarr.fukurokuju.dev"
   internal_host                = "http://192.168.1.3:38013/"
   internal_host_ssl_validation = false
@@ -127,7 +132,7 @@ module "radarr" {
   source                       = "../modules/authentik-proxy"
   app_name                     = "Radarr"
   app_slug                     = "radarr"
-  app_access_group_id          = authentik_group.admins.id
+  app_access_group_id          = authentik_group.arrs.id
   app_url                      = "https://radarr.fukurokuju.dev"
   internal_host                = "http://192.168.1.3:38012/"
   internal_host_ssl_validation = false
@@ -138,7 +143,7 @@ module "lidarr" {
   source                       = "../modules/authentik-proxy"
   app_name                     = "Lidarr"
   app_slug                     = "lidarr"
-  app_access_group_id          = authentik_group.admins.id
+  app_access_group_id          = authentik_group.arrs.id
   app_url                      = "https://lidarr.fukurokuju.dev"
   internal_host                = "http://192.168.1.3:38010/"
   internal_host_ssl_validation = false
@@ -149,7 +154,7 @@ module "qbit" {
   source                       = "../modules/authentik-proxy"
   app_name                     = "qBit"
   app_slug                     = "qbit"
-  app_access_group_id          = authentik_group.admins.id
+  app_access_group_id          = authentik_group.arrs.id
   app_url                      = "https://qbit.fukurokuju.dev"
   internal_host                = "http://192.168.1.3:30024"
   internal_host_ssl_validation = false