diff --git a/hosts/hardware/vm.nix b/hosts/hardware/vm.nix
index 4a2b362..4835766 100644
--- a/hosts/hardware/vm.nix
+++ b/hosts/hardware/vm.nix
@@ -34,15 +34,17 @@
     cores = 4;
     diskSize = 32768;   # docker images for shelfarr/profilarr are not small
     graphics = false;   # serial console; ctrl-a x to quit
+    # Host side is offset by 10000 so the VM can run on the mediaserver
+    # itself without fighting the live services for those ports.
     forwardPorts = [
-      { from = "host"; host.port = 2222; guest.port = 22; }
-      { from = "host"; host.port = 8989; guest.port = 8989; }  # sonarr
-      { from = "host"; host.port = 7878; guest.port = 7878; }  # radarr
-      { from = "host"; host.port = 9696; guest.port = 9696; }  # prowlarr
-      { from = "host"; host.port = 6767; guest.port = 6767; }  # bazarr
-      { from = "host"; host.port = 8080; guest.port = 8080; }  # qbittorrent
-      { from = "host"; host.port = 8096; guest.port = 8096; }  # jellyfin
-      { from = "host"; host.port = 5055; guest.port = 5055; }  # seerr
+      { from = "host"; host.port = 10022; guest.port = 22; }    # ssh
+      { from = "host"; host.port = 18989; guest.port = 8989; }  # sonarr
+      { from = "host"; host.port = 17878; guest.port = 7878; }  # radarr
+      { from = "host"; host.port = 19696; guest.port = 9696; }  # prowlarr
+      { from = "host"; host.port = 16767; guest.port = 6767; }  # bazarr
+      { from = "host"; host.port = 18080; guest.port = 8080; }  # qbittorrent
+      { from = "host"; host.port = 18096; guest.port = 8096; }  # jellyfin
+      { from = "host"; host.port = 15055; guest.port = 5055; }  # seerr
     ];
   };
 }