diff --git a/services/arr/recyclarr.nix b/services/arr/recyclarr.nix
index 1dd9876..4d2d61a 100644
--- a/services/arr/recyclarr.nix
+++ b/services/arr/recyclarr.nix
@@ -8,18 +8,20 @@
 let
   radarrConfig = "${service_configs.radarr.dataDir}/config.xml";
   sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml";
-  appDataDir = "${service_configs.recyclarr.dataDir}/data";
+  configPath = "/var/lib/recyclarr/config.json";
 
-  # Runs as root (via + prefix) to read API keys, writes secrets.yml for recyclarr
-  generateSecrets = pkgs.writeShellScript "recyclarr-generate-secrets" ''
-    RADARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
-    SONARR_KEY=$(${pkgs.gnugrep}/bin/grep -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
-    cat > ${appDataDir}/secrets.yml <<EOF
-    movies_api_key: $RADARR_KEY
-    series_api_key: $SONARR_KEY
-    EOF
-    chown recyclarr:recyclarr ${appDataDir}/secrets.yml
-    chmod 600 ${appDataDir}/secrets.yml
+  # Runs as root (via + prefix) after the NixOS module writes config.json.
+  # Extracts API keys from radarr/sonarr config.xml and injects them via jq.
+  injectApiKeys = pkgs.writeShellScript "recyclarr-inject-api-keys" ''
+    RADARR_KEY=$(${lib.getExe pkgs.gnugrep} -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
+    SONARR_KEY=$(${lib.getExe pkgs.gnugrep} -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
+    ${pkgs.jq}/bin/jq \
+      --arg rk "$RADARR_KEY" \
+      --arg sk "$SONARR_KEY" \
+      '.radarr.movies.api_key = $rk | .sonarr.series.api_key = $sk' \
+      ${configPath} > ${configPath}.tmp
+    mv ${configPath}.tmp ${configPath}
+    chown recyclarr:recyclarr ${configPath}
   '';
 in
 {
@@ -31,7 +33,6 @@ in
 
   systemd.tmpfiles.rules = [
     "d ${service_configs.recyclarr.dataDir} 0755 recyclarr recyclarr -"
-    "d ${appDataDir} 0755 recyclarr recyclarr -"
   ];
 
   services.recyclarr = {
@@ -55,11 +56,15 @@ in
           {
             name = "Remux + WEB 2160p";
             min_format_score = 0;
+            reset_unmatched_scores = {
+              enabled = true;
+            };
             upgrade = {
               allowed = true;
               until_quality = "Remux-2160p";
-              until_score = 0;
+              until_score = 10000;
             };
+            quality_sort = "top";
             qualities = [
               { name = "Remux-2160p"; }
               {
@@ -130,11 +135,15 @@ in
           {
             name = "WEB-2160p";
             min_format_score = 0;
+            reset_unmatched_scores = {
+              enabled = true;
+            };
             upgrade = {
               allowed = true;
               until_quality = "WEB 2160p";
-              until_score = 0;
+              until_score = 10000;
             };
+            quality_sort = "top";
             qualities = [
               {
                 name = "WEB 2160p";
@@ -201,6 +210,6 @@ in
       "sonarr.service"
     ];
     wants = [ "network-online.target" ];
-    serviceConfig.ExecStartPre = "+${generateSecrets}";
+    serviceConfig.ExecStartPre = [ "+${injectApiKeys}" ];
   };
 }