diff --git a/flake.lock b/flake.lock
index bb12c0c..4385e1c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -737,11 +737,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731892054,
-        "narHash": "sha256-BJtD9NGUWaBe4OZ1JO77w8qBP9yHDJJUjsxkG/milFc=",
+        "lastModified": 1732151224,
+        "narHash": "sha256-5IgpueM8SGLOadzUJK6Gk37zEBXGd56BkNOtoWmnZos=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "15a87ccb45e06d24a9fd5f99a49782efe11b23f0",
+        "rev": "3280fdde8c8f0276c9f5286ad5c0f433dfa5d56c",
         "type": "github"
       },
       "original": {
@@ -876,11 +876,11 @@
     },
     "nixstable": {
       "locked": {
-        "lastModified": 1727672256,
-        "narHash": "sha256-9/79hjQc9+xyH+QxeMcRsA6hDyw6Z9Eo1/oxjvwirLk=",
+        "lastModified": 1731797254,
+        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1719f27dd95fd4206afb9cec9f415b539978827e",
+        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
         "type": "github"
       },
       "original": {
@@ -918,11 +918,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1730550779,
-        "narHash": "sha256-2stntmqw/GBOVEoPV4oCLHZljpeSBfZn8wkcJpei+ng=",
+        "lastModified": 1731959181,
+        "narHash": "sha256-RryrMTaCvmXzhl0lYm/jAG8bAxsAhEcNq1JRtkCL4wI=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "91c06026075f08a3c865fdc46cc6db8e2af35a1e",
+        "rev": "8d29728abfcc2e4207afb3fd8606feff17c15cec",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index ff11c8e..fd8ce95 100644
--- a/flake.nix
+++ b/flake.nix
@@ -108,7 +108,7 @@
             pkgs = import top.nixstable { inherit system overlays; };
           };
 
-          packages = import ./pkgs { inherit pkgs top; };
+          packages = (import ./pkgs { inherit pkgs top; }) // (import ./vms { inherit top; });
 
           checks = import ./checks.nix {
             inherit system;
diff --git a/hosts/default.nix b/hosts/default.nix
index 57d1438..2aad610 100644
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -63,6 +63,7 @@ in
   jeremiah = unstable { name = "jeremiah"; };
   isaiah = unstable { name = "isaiah"; };
 
+  vm-jellyfin = vm { name = "vm-jellyfin"; };
   vm-matrix = vm { name = "vm-matrix"; };
 
   iso = machine { name = "iso"; };
diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix
index 34ed93d..84ea036 100644
--- a/hosts/genesis/networking.nix
+++ b/hosts/genesis/networking.nix
@@ -60,8 +60,6 @@ in
       allowedUDPPorts = [
         dhcpPort
         dnsPort
-        1900 # Jellyfin auto-discovery
-        7359 # Jellyfin auto-discovery
       ];
       allowedTCPPorts = [
         dnsPort
@@ -74,21 +72,7 @@ in
 
   environment.etc."hosts.d/local".text = extraHosts;
 
-  fileSystems = {
-    "/media" = {
-      device = "10.42.1.4:/volume1/video/";
-      fsType = "nfs";
-      options = [ "ro" ];
-    };
-  };
-
   services = {
-    # Video services
-    jellyfin = {
-      enable = true;
-      openFirewall = true;
-    };
-
     #########
     # Blind service proxy behind the walls of the VPN
     ########
@@ -146,10 +130,6 @@ in
     };
   }; # End of services configuration
 
-  greg.proxies = {
-    "jellyfin.home".target = "http://localhost:8096/";
-  };
-
   environment.systemPackages = with pkgs; [
     bind
     curl # Used by dnsmasq fetching
diff --git a/hosts/genesis/networking/dhcp.nix b/hosts/genesis/networking/dhcp.nix
index 6e47005..9ab297c 100644
--- a/hosts/genesis/networking/dhcp.nix
+++ b/hosts/genesis/networking/dhcp.nix
@@ -108,18 +108,26 @@
       #  hw-address = ""; # hosea
       #  ip-address = "10.42.1.7";
       #}
-      #{
-      #  hw-address = ""; # jeremiah
-      #  ip-address = "10.42.1.8";
-      #}
+      {
+        hw-address = "b4:2e:99:aa:22:3c"; # jeremiah
+        ip-address = "10.42.1.8";
+      }
       {
         hw-address = "c8:5e:a9:54:9e:c6"; # IVR laptop Wi-Fi
         ip-address = "10.42.1.9";
       }
 
+      ########################################
+      #             VM servers               #
+      ########################################
+
       {
         hw-address = "52:54:00:2a:74:2f";
-        ip-address = "10.43.4.1";
+        ip-address = "10.43.4.1"; # Dendrite
+      }
+      {
+        hw-address = "52:54:00:6e:eb:83";
+        ip-address = "10.43.4.2"; # Jellyfin
       }
 
       ########################################
diff --git a/hosts/isaiah/default.nix b/hosts/isaiah/default.nix
index 1083294..828c047 100644
--- a/hosts/isaiah/default.nix
+++ b/hosts/isaiah/default.nix
@@ -12,7 +12,10 @@
 
   virtualisation.libvirtd = {
     enable = true;
-    allowedBridges = [ "virbr0" ];
+    allowedBridges = [
+      "br0"
+      "virbr0"
+    ];
     onBoot = "ignore"; # only restart VMs labeled 'autostart'
     qemu.ovmf.enable = true;
   };
@@ -26,12 +29,15 @@
   networking = {
     hostName = "isaiah";
     useDHCP = false;
+    bridges.br0 = {
+      interfaces = [ "enp38s0" ];
+    };
     defaultGateway = {
       address = " 10.42.1.1";
-      interface = "enp38s0";
+      interface = "br0";
     };
     interfaces = {
-      enp38s0 = {
+      br0 = {
         ipv4.addresses = [
           {
             address = "10.42.1.6";
diff --git a/hosts/vm-jellyfin/default.nix b/hosts/vm-jellyfin/default.nix
new file mode 100644
index 0000000..034b6be
--- /dev/null
+++ b/hosts/vm-jellyfin/default.nix
@@ -0,0 +1,41 @@
+{ ... }:
+
+{
+  imports = [ ];
+  #boot.loader.grub.devices = [ "/dev/vda" ];
+
+  greg = {
+    proxies."jellyfin.home".target = "http://localhost:8096/";
+    tailscale.enable = true;
+  };
+
+  fileSystems = {
+    "/music" = {
+      device = "10.42.1.4:/volume1/music";
+      fsType = "nfs";
+      options = [ "ro" ];
+    };
+    "/photo" = {
+      device = "10.42.1.4:/volume1/photo";
+      fsType = "nfs";
+      options = [ "ro" ];
+    };
+    "/video" = {
+      device = "10.42.1.4:/volume1/video/";
+      fsType = "nfs";
+      options = [ "ro" ];
+    };
+  };
+
+  networking = {
+    hostName = "vm-jellyfin";
+    domain = "thehellings.lan";
+  };
+
+  services.jellyfin = {
+    enable = true;
+    openFirewall = true;
+  };
+
+  virtualisation.diskSize = 100 * 1024;
+}
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 82e9157..30033d6 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -41,7 +41,7 @@ in
     xfsprogs
   ];
 
-  system.stateVersion = "24.05";
+  system.stateVersion = "24.11";
 
   nix = {
     gc.dates = "weekly";
@@ -93,6 +93,7 @@ in
       "networkmanager"
     ]; # Enable ‘sudo’ for the user.
     shell = config.programs.xonsh.package;
+    initialPassword = "password";
     openssh.authorizedKeys.keys = lib.strings.splitString "\n" (
       builtins.readFile ../../home/ssh/authorized_keys
     );
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 955e72c..0ef1c91 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, top, ... }:
+{ pkgs, ... }:
 
 let
   c = pkgs.callPackage;
@@ -16,6 +16,4 @@ in
   setup-ssh = c ./setup-ssh { };
   upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };
   zim = c ./zim.nix { };
-
-  matrix = top.nixosConfigurations.vm-matrix.config.formats.qcow;
 }
diff --git a/vms/default.nix b/vms/default.nix
new file mode 100644
index 0000000..9adeb1b
--- /dev/null
+++ b/vms/default.nix
@@ -0,0 +1,6 @@
+{ top, ... }:
+with top.self.nixosConfigurations;
+{
+  jellyfin = vm-jellyfin.config.formats.qcow;
+  matrix = vm-matrix.config.formats.qcow;
+}