diff --git a/flake.lock b/flake.lock
index 8d96a0a..e7a398e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -8,11 +8,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1790642832,
-        "narHash": "sha256-dhAifTJeh8sfK0s/KzUZIo1qHlv+AFit3HOyCT+QC5E=",
+        "lastModified": 1791759048,
+        "narHash": "sha256-/KMQbdh5X6Sa1GTUqyKf3vHdHDgpuRfJr9iHommwiH8=",
         "owner": "ogulcancelik",
         "repo": "herdr",
-        "rev": "9dc3a1df2b563df0637264fc0dffcd607c324ac5",
+        "rev": "dc6b6e5f42831ea7114f34dcf12900680eb36ae0",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790215976,
-        "narHash": "sha256-VkR1rMGyjU9jtw8ISFx5uqR9e+LEaOlhHwrseFkiIVk=",
+        "lastModified": 1790996401,
+        "narHash": "sha256-f+kOxEmOUnQazVAmGg0i8hzwgd1kX/geY+k/Dpheye8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a6631107a83ceab5872f298a2ea710859c80c4cb",
+        "rev": "db7d5e2332710f5abb088f6b5de927d7f9511b35",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790533781,
-        "narHash": "sha256-hzJtu90JIQXnmgxKeP23CAx86G4L+dcQ+GHB1JK04qA=",
-        "rev": "cf5e76507c6e23b59f7e0ffcc7baa2a39ddd8442",
+        "lastModified": 1791662279,
+        "narHash": "sha256-tM6MAMxVwetta6uD2aMzoWQ9v5EAaLLmYumiE4jVZeg=",
+        "rev": "6fcc160353f63555b560f25588925133c8f61f2a",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.10769.cf5e76507c6e/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.11680.6fcc160353f6/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
diff --git a/hosts/nixserve/default.nix b/hosts/nixserve/default.nix
index eec65e7..d9884b4 100644
--- a/hosts/nixserve/default.nix
+++ b/hosts/nixserve/default.nix
@@ -47,8 +47,8 @@
   users.groups.media = {};
   users.users.jellyfin.extraGroups = [ "media" ];
 
-  networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ ];
-  networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ ];
+  networking.firewall.allowedTCPPorts = [ 80 443 /* HTTP */ 111 2049 4000 4001 4002 20048 /* NFS */ 3923 /* copyparty */ 8123 /* Home Assistant (LAN devices, e.g. Cast TTS fetch) */ 8095 /* Music Assistant */ ];
+  networking.firewall.allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 /* NFS */ 5353 /* mDNS - Chromecast discovery */ ];
   networking.firewall.trustedInterfaces = [ "tailscale0" ];
 
   programs.zsh.enable = true;
diff --git a/hosts/nixserve/services.nix b/hosts/nixserve/services.nix
index d876a31..77d8914 100644
--- a/hosts/nixserve/services.nix
+++ b/hosts/nixserve/services.nix
@@ -52,6 +52,17 @@ in
 
   services.jellyfin.enable = true;
 
+  services.paperless = {
+    enable = true;
+    dataDir = "/media/apps/paperless";
+    address = "127.0.0.1";
+    port = 28981;
+    domain = "paperless.maybec.at";
+    settings = {
+      PAPERLESS_OCR_LANGUAGE = "eng+swe";
+    };
+  };
+
   services.tailscale = {
     enable = true;
     openFirewall = true;
@@ -313,5 +324,6 @@ virtualHosts."aftersummer.maybec.at"  = proxyVhost { upstream = "http://127.0.0.
     virtualHosts."share.maybec.at"       = proxyVhost { upstream = "http://127.0.0.1:8090"; maxBodySize = "10g"; };
     virtualHosts."cam.maybec.at"         = proxyVhost { upstream = "https://127.0.0.1:8971"; proxySsl = true; };
     virtualHosts."home.maybec.at"        = proxyVhost { upstream = "http://127.0.0.1:8123"; };
+    virtualHosts."paperless.maybec.at"   = proxyVhost { upstream = "http://127.0.0.1:28981"; };
   };
 }