diff --git a/README.md b/README.md
index 1917cb8..fdeba66 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,10 @@ mkdir -p /srv/jellyfin/{config,cache}
 docker run -d -v /srv/jellyfin/config:/config -v /srv/jellyfin/cache:/cache -v /media:/media --net=host jellyfin/jellyfin:latest
 ```
 
+## Traefik
+
+<https://jellyfin.org/docs/general/networking/traefik2.html>
+
 ## Copy lots of files
 
 ```bash
diff --git a/jellyfin/templates/deploy.yaml b/jellyfin/templates/deploy.yaml
index d27f211..c5fac25 100644
--- a/jellyfin/templates/deploy.yaml
+++ b/jellyfin/templates/deploy.yaml
@@ -28,8 +28,7 @@ spec:
             fieldRef:
               apiVersion: v1
               fieldPath: metadata.namespace
-        image: jellyfin/jellyfin:latest
-        imagePullPolicy: Always
+        image: jellyfin/jellyfin:10.6.4
         name: jellyfin
         ports:
         - containerPort: 8096
@@ -37,8 +36,11 @@ spec:
         volumeMounts:
           - mountPath: /config
             name: config
+          - mountPath: /cache
+            name: cache
           - mountPath: /media
             name: media
+            readOnly: true
         resources:
           limits:
             memory: "8Gi"
@@ -51,6 +53,9 @@ spec:
         - name: config
           persistentVolumeClaim:
             claimName: {{ .Release.Name }}
+        - name: cache
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-cache
         - name: media
           persistentVolumeClaim:
             claimName: nfs-media
\ No newline at end of file
diff --git a/jellyfin/templates/ingress.yaml b/jellyfin/templates/ingress.yaml
index ade9c86..cfa0e2c 100644
--- a/jellyfin/templates/ingress.yaml
+++ b/jellyfin/templates/ingress.yaml
@@ -17,6 +17,8 @@ spec:
     services:
     - name: {{ .Release.Name }}
       port: 8096
+    middlewares:
+      - name: {{ .Release.Name }}
 
 ---
 
@@ -57,6 +59,8 @@ spec:
     services:
     - name: {{ .Release.Name }}
       port: 8096
+    middlewares:
+      - name: {{ .Release.Name }}
 
 ---
 
diff --git a/jellyfin/templates/middleware.yaml b/jellyfin/templates/middleware.yaml
new file mode 100644
index 0000000..62bc01d
--- /dev/null
+++ b/jellyfin/templates/middleware.yaml
@@ -0,0 +1,18 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: jellyfin
+spec:
+  headers:
+    customResponseHeaders:
+      X-Robots-Tag: "noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"
+    SSLHost: "jellyfin.ducoterra.net"
+    SSLForceHost: true
+    STSSeconds: "315360000"
+    STSIncludeSubdomains: true
+    STSPreload: true
+    forceSTSHeader: true
+    frameDeny: true
+    contentTypeNosniff: true
+    browserXSSFilter: true
+    customFrameOptionsValue: "https://jellyfin.ducoterra.net"
\ No newline at end of file
diff --git a/jellyfin/templates/pvc.yaml b/jellyfin/templates/pvc.yaml
index 8fb4ec9..f7283cd 100644
--- a/jellyfin/templates/pvc.yaml
+++ b/jellyfin/templates/pvc.yaml
@@ -11,3 +11,17 @@ spec:
   resources:
     requests:
       storage: 32Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-cache
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  storageClassName: nvme
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 32Gi