diff --git a/ansible/roles/media_stack/tasks/main.yml b/ansible/roles/media_stack/tasks/main.yml
index 6a28d95..4168642 100644
--- a/ansible/roles/media_stack/tasks/main.yml
+++ b/ansible/roles/media_stack/tasks/main.yml
@@ -12,6 +12,7 @@
     mode: '0644'
   loop:
     - radarr
+    - sonarr
     - prowlarr
     - lidarr
     - whisparr
@@ -25,6 +26,7 @@
     enabled: true
   loop:
     - radarr
+    - sonarr
     - prowlarr
     - lidarr
     - ollama
@@ -59,7 +61,6 @@
     state: started
     enabled: true
   loop:
-    - sonarr
     - jellyfin
     - plexmediaserver
     - transmission-daemon
diff --git a/ansible/services/sonarr/README.md b/ansible/services/sonarr/README.md
index fc08141..55e63fe 100644
--- a/ansible/services/sonarr/README.md
+++ b/ansible/services/sonarr/README.md
@@ -6,13 +6,26 @@ TV series management and automated downloading.
 
 - **Host:** london-b
 - **Install method:** APT package (`sonarr` v3, mono-based)
-- **Service:** `sonarr.service` (package-managed unit file — do not override)
+- **Service:** `sonarr.service` (in this directory, deployed to
+  `/etc/systemd/system/` by the `media_stack` role)
 - **Data directory:** `/var/lib/sonarr`
 - **Web UI:** `sonarr.pez.sh` (proxied via Caddy on helsinki-a)
-- **Managed by:** `media_stack` Ansible role (ensures service is enabled and started)
+- **Managed by:** `media_stack` Ansible role (deploys the unit, then ensures it
+  is enabled and started)
 
 ## Notes
 
-Unlike radarr/lidarr/prowlarr (which use manually installed binaries with custom unit files), sonarr is installed via APT and its systemd unit is owned by the package. Use `dpkg-reconfigure -plow sonarr` to change User/Group/UMask settings rather than editing the unit file directly.
+The APT package ships its own unit at `/usr/lib/systemd/system/sonarr.service`.
+The unit here was captured from that running unit and is deployed to
+`/etc/systemd/system/sonarr.service`, which overrides the package copy so the
+unit lives in IaC alongside the other *arr services (radarr / lidarr /
+prowlarr). Because of the override, package updates to the unit no longer apply
+automatically — re-capture this file if the package unit changes.
 
-The `media_stack` role also sets up a midnight cron restart (`systemctl restart sonarr`).
+Unlike radarr/lidarr/prowlarr (manually installed `/opt` binaries), Sonarr is
+mono-based, so `ExecStart` runs `Sonarr.exe` via `/usr/bin/mono`. To change
+User/Group/UMask/-data, edit `sonarr.service` here rather than running
+`dpkg-reconfigure -plow sonarr`.
+
+The `media_stack` role also sets up a midnight cron restart
+(`systemctl restart sonarr`).
diff --git a/ansible/services/sonarr/sonarr.service b/ansible/services/sonarr/sonarr.service
new file mode 100644
index 0000000..75c74d9
--- /dev/null
+++ b/ansible/services/sonarr/sonarr.service
@@ -0,0 +1,23 @@
+# Managed by the pez-infra media_stack Ansible role.
+# Captured from the running sonarr v3 (APT/mono) unit on london-b.
+# Unlike radarr/lidarr/prowlarr (manually installed /opt binaries), Sonarr is
+# the APT package, so ExecStart runs the mono-based Sonarr.exe. Deploying this
+# to /etc/systemd/system overrides the package-owned unit in
+# /usr/lib/systemd/system so the unit is captured in IaC.
+[Unit]
+Description=Sonarr Daemon
+After=network.target
+
+[Service]
+User=root
+Group=root
+UMask=0002
+
+Type=simple
+ExecStart=/usr/bin/mono --debug /usr/lib/sonarr/bin/Sonarr.exe -nobrowser -data=/var/lib/sonarr
+TimeoutStopSec=20
+KillMode=process
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target