diff --git a/systems/hakurei/nixos.nix b/systems/hakurei/nixos.nix
index e2b54744..13b0f8d4 100644
--- a/systems/hakurei/nixos.nix
+++ b/systems/hakurei/nixos.nix
@@ -1,6 +1,7 @@
 {
   config,
   meta,
+  access,
   ...
 }: {
   imports = let
@@ -13,6 +14,7 @@
     nixos.cloudflared
     nixos.nginx
     nixos.access.proxmox
+    nixos.access.plex
   ];
 
   sops.secrets.cloudflared-tunnel-hakurei = {
@@ -31,6 +33,12 @@
     };
   };
 
+  services.nginx.access = {
+    plex.url = let
+      system = access.systemFor "mediabox";
+    in "http://${system.networking.access.hostnameForNetwork.local}:32400";
+  };
+
   systemd.network.networks.eth0 = {
     name = "eth0";
     matchConfig = {
diff --git a/systems/mediabox/nixos.nix b/systems/mediabox/nixos.nix
index 9ce56028..d78fb7c9 100644
--- a/systems/mediabox/nixos.nix
+++ b/systems/mediabox/nixos.nix
@@ -37,7 +37,6 @@
       default = "http_status:404";
       credentialsFile = config.sops.secrets.cloudflare_mediabox_tunnel.path;
       ingress = {
-        "plex.gensokyo.zone".service = "http://localhost:32400";
         "tautulli.gensokyo.zone".service = "http://localhost:${toString config.services.tautulli.port}";
         "ombi.gensokyo.zone".service = "http://localhost:${toString config.services.ombi.port}";
         "sonarr.gensokyo.zone".service = "http://localhost:8989";
diff --git a/tf/cloudflare_tunnels.tf b/tf/cloudflare_tunnels.tf
index 421c0b05..11d4b104 100644
--- a/tf/cloudflare_tunnels.tf
+++ b/tf/cloudflare_tunnels.tf
@@ -72,7 +72,6 @@ module "mediabox" {
   zone_id    = cloudflare_zone.gensokyo-zone_zone.id
   subdomains = [
     "deluge",
-    "plex",
     "sonarr",
     "radarr",
     "jackett",