diff --git a/lib/default.nix b/lib/default.nix
index 611e0a8..0d26ebf 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -4,7 +4,7 @@ rec {
     let
       configWithTemplates = withReplacements userConfig;
 
-      nonSecretConfigFile = pkgs.writeText "${resultPath}.template" (generator configWithTemplates);
+      nonSecretConfigFile = pkgs.writeText "${resultPath}.template" (generator "template" configWithTemplates);
 
       replacements = getReplacements userConfig;
     in
@@ -13,7 +13,11 @@ rec {
         inherit resultPath replacements;
       };
 
-  template = file: newPath: replacements: replaceSecretsScript { inherit file replacements; resultPath = newPath; };
+  template = file: newPath: replacements: replaceSecretsScript {
+    inherit file replacements;
+    resultPath = newPath;
+  };
+
   replaceSecretsScript = { file, resultPath, replacements }:
     let
       templatePath = resultPath + ".template";
@@ -25,7 +29,11 @@ rec {
       mkdir -p $(dirname ${templatePath})
       ln -fs ${file} ${templatePath}
       rm -f ${resultPath}
-      ${pkgs.gnused}/bin/sed ${sedPatterns} ${templatePath} > ${resultPath}
+      if [ -z "${sedPatterns}" ]; then
+        cat ${templatePath} > ${resultPath}
+      else
+        ${pkgs.gnused}/bin/sed ${sedPatterns} ${templatePath} > ${resultPath}
+      fi
       '';
 
   secretFileType = lib.types.submodule {
diff --git a/modules/blocks/authelia.nix b/modules/blocks/authelia.nix
index af3928d..ac7d26a 100644
--- a/modules/blocks/authelia.nix
+++ b/modules/blocks/authelia.nix
@@ -341,7 +341,7 @@ in
               identity_providers.oidc.clients = clients;
             };
             resultPath = "/var/lib/authelia-${fqdn}/oidc_clients.yaml";
-            generator = lib.generators.toYAML {};
+            generator = name: value: lib.generators.toYAML {} value;
           };
       in
         lib.mkBefore (mkCfg cfg.oidcClients);
diff --git a/modules/services/arr.nix b/modules/services/arr.nix
index 895d0c1..8567a5c 100644
--- a/modules/services/arr.nix
+++ b/modules/services/arr.nix
@@ -306,7 +306,7 @@ let
       };
     in valueType;
 
-    generate = value: builtins.readFile (pkgs.callPackage ({ runCommand, python3 }: runCommand "config" {
+    generate = name: value: builtins.readFile (pkgs.callPackage ({ runCommand, python3 }: runCommand "config" {
       value = builtins.toJSON {Config = value;};
       passAsFile = [ "value" ];
     } (pkgs.writers.writePython3 "dict2xml" {
@@ -381,7 +381,7 @@ in
 {
   options.shb.arr = lib.listToAttrs (lib.mapAttrsToList appOption apps);
 
-  config = lib.mkMerge ([
+  config = lib.mkMerge [
     (lib.mkIf cfg.radarr.enable (
     let
       cfg' = cfg.radarr;
@@ -395,10 +395,6 @@ in
         dataDir = "/var/lib/radarr";
       };
 
-      users.users.radarr = {
-        extraGroups = [ "media" ];
-      };
-
       systemd.services.radarr.preStart = shblib.replaceSecrets {
         userConfig = cfg'.settings
                      // (lib.optionalAttrs isSSOEnabled {
@@ -417,7 +413,8 @@ in
         ];
         excludePatterns = [".db-shm" ".db-wal" ".mono"];
       };
-    } // backup "radarr"))
+    }))
+    (lib.mkIf cfg.radarr.enable (backup "radarr"))
 
     (lib.mkIf cfg.sonarr.enable (
     let
@@ -453,11 +450,13 @@ in
         ];
         excludePatterns = [".db-shm" ".db-wal" ".mono"];
       };
-    } // backup "sonarr"))
+    }))
+    (lib.mkIf cfg.sonarr.enable (backup "sonarr"))
 
     (lib.mkIf cfg.bazarr.enable (
     let
       cfg' = cfg.bazarr;
+      isSSOEnabled = !(isNull cfg'.authEndpoint);
     in
     {
       services.bazarr = {
@@ -468,8 +467,12 @@ in
         extraGroups = [ "media" ];
       };
       systemd.services.bazarr.preStart = shblib.replaceSecrets {
-        userConfig = cfg'.settings;
-        resultPath = "/var/lib/${config.systemd.services.bazarr.serviceConfig.StateDirectory}/config.xml";
+        userConfig = cfg'.settings
+                     // (lib.optionalAttrs isSSOEnabled {
+                       AuthenticationRequired = "DisabledForLocalAddresses";
+                       AuthenticationMethod = "External";
+                     });
+        resultPath = "/var/lib/bazarr/config.xml";
         generator = apps.bazarr.settingsFormat.generate;
       };
 
@@ -481,7 +484,8 @@ in
         ];
         excludePatterns = [".db-shm" ".db-wal" ".mono"];
       };
-    } // backup "bazarr"))
+    }))
+    (lib.mkIf cfg.bazarr.enable (backup "sonarr"))
 
     (lib.mkIf cfg.readarr.enable (
     let
@@ -509,11 +513,13 @@ in
         ];
         excludePatterns = [".db-shm" ".db-wal" ".mono"];
       };
-    } // backup "readarr"))
+    }))
+    (lib.mkIf cfg.readarr.enable (backup "bazarr"))
 
     (lib.mkIf cfg.lidarr.enable (
     let
       cfg' = cfg.lidarr;
+      isSSOEnabled = !(isNull cfg'.authEndpoint);
     in
     {
       services.lidarr = {
@@ -524,7 +530,11 @@ in
         extraGroups = [ "media" ];
       };
       systemd.services.lidarr.preStart = shblib.replaceSecrets {
-        userConfig = cfg'.settings;
+        userConfig = cfg'.settings
+                     // (lib.optionalAttrs isSSOEnabled {
+                       AuthenticationRequired = "DisabledForLocalAddresses";
+                       AuthenticationMethod = "External";
+                     });
         resultPath = "${config.services.lidarr.dataDir}/config.xml";
         generator = apps.lidarr.settingsFormat.generate;
       };
@@ -537,7 +547,8 @@ in
         ];
         excludePatterns = [".db-shm" ".db-wal" ".mono"];
       };
-    } // backup "lidarr"))
+    }))
+    (lib.mkIf cfg.lidarr.enable (backup "readarr"))
 
     (lib.mkIf cfg.jackett.enable (
     let
@@ -553,7 +564,7 @@ in
       };
       systemd.services.jackett.preStart = shblib.replaceSecrets {
         userConfig = cfg'.settings;
-        resultPath = "${config.services.jackett.dataDir}/config.xml";
+        resultPath = "${config.services.jackett.dataDir}/ServerConfig.json";
         generator = apps.jackett.settingsFormat.generate;
       };
 
@@ -567,6 +578,7 @@ in
         ];
         excludePatterns = [".db-shm" ".db-wal" ".mono"];
       };
-    } // backup "jackett"))
-  ]);
+    }))
+    (lib.mkIf cfg.jackett.enable (backup "lidarr"))
+  ];
 }
diff --git a/modules/services/home-assistant.nix b/modules/services/home-assistant.nix
index 6790c10..4593469 100644
--- a/modules/services/home-assistant.nix
+++ b/modules/services/home-assistant.nix
@@ -299,7 +299,7 @@ in
         '' + shblib.replaceSecrets {
           userConfig = cfg.config;
           resultPath = "${config.services.home-assistant.configDir}/secrets.yaml";
-          generator = lib.generators.toYAML {};
+          generator = name: value: lib.generators.toYAML {} value;
         });
 
     systemd.tmpfiles.rules = [
diff --git a/modules/services/vaultwarden.nix b/modules/services/vaultwarden.nix
index dc9d83c..dde963a 100644
--- a/modules/services/vaultwarden.nix
+++ b/modules/services/vaultwarden.nix
@@ -155,7 +155,7 @@ in
           SMTP_PASSWORD.source = cfg.smtp.passwordFile;
         };
         resultPath = "/var/lib/bitwarden_rs/vaultwarden.env";
-        generator = v: lib.generators.toINIWithGlobalSection {} { globalSection = v; };
+        generator = name: v: lib.generators.toINIWithGlobalSection {} { globalSection = v; };
       };
 
     shb.nginx.autheliaProtect = [
diff --git a/test/modules/arr.nix b/test/modules/arr.nix
index cb4ea2f..2fbe58f 100644
--- a/test/modules/arr.nix
+++ b/test/modules/arr.nix
@@ -126,7 +126,7 @@ in
         enable = true;
         authEndpoint = "https://oidc.example.com";
         settings = {
-          APIKeyFile = "/run/radarr/apikey";
+          APIKey.source = pkgs.writeText "key" "/run/radarr/apikey";
         };
       };
     };
@@ -199,7 +199,7 @@ in
         enable = true;
         authEndpoint = "https://oidc.example.com";
         settings = {
-          APIKeyFile = "/run/radarr/apikey";
+          APIKey.source = pkgs.writeText "key" "/run/radarr/apikey";
         };
         backupCfg = {
           enable = true;
diff --git a/test/vm/lib.nix b/test/vm/lib.nix
index 8ee7db1..681e89e 100644
--- a/test/vm/lib.nix
+++ b/test/vm/lib.nix
@@ -39,7 +39,7 @@ in
       replaceInTemplate2 = shblib.replaceSecrets {
         inherit userConfig;
         resultPath = "/var/lib/config2.yaml";
-        generator = lib.generators.toJSON {};
+        generator = name: value: lib.generators.toJSON {} value;
       };
     in
       pkgs.testers.runNixOSTest {