diff --git a/apps/aiostreams/compose.yaml b/apps/aiostreams/compose.yaml
index 3e10f96..753e2d1 100644
--- a/apps/aiostreams/compose.yaml
+++ b/apps/aiostreams/compose.yaml
@@ -12,6 +12,7 @@ services:
       - "traefik.http.routers.aiostreams.rule=Host(`${AIOSTREAMS_HOSTNAME?}`)"
       - "traefik.http.routers.aiostreams.entrypoints=websecure"
       - "traefik.http.routers.aiostreams.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.aiostreams.middlewares=authelia@docker"
       - "flame.type=app"
       - "flame.name=AIOStreams"
       - "flame.url=https://${AIOSTREAMS_HOSTNAME}"
diff --git a/apps/aiostremio/compose.yaml b/apps/aiostremio/compose.yaml
index 810ceb0..dd4e66a 100644
--- a/apps/aiostremio/compose.yaml
+++ b/apps/aiostremio/compose.yaml
@@ -14,6 +14,7 @@ services:
       - "traefik.http.routers.aiostremio.rule=Host(`${AIOSTREMIO_HOSTNAME?}`)"
       - "traefik.http.routers.aiostremio.entrypoints=websecure"
       - "traefik.http.routers.aiostremio.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.aiostremio.middlewares=authelia@docker"
       - "flame.type=app"
       - "flame.name=AIOStremio"
       - "flame.url=https://${AIOSTREMIO_HOSTNAME}"
diff --git a/apps/authelia/.env b/apps/authelia/.env
index 0a200d4..8375f3c 100644
--- a/apps/authelia/.env
+++ b/apps/authelia/.env
@@ -44,3 +44,11 @@ AUTHELIA_SUBDOMAIN=auth
 # This will be located in the notification.txt file in the same directory as the users.yml file.
 # You can run this command to view the file, replacing ${DOCKER_DATA_DIR} with its actual value:
 # cat ${DOCKER_DATA_DIR}/data/authelia/config/notification.txt
+
+# To protect your Stremio addon configure pages, set the value below to a list of subdomains of your stremio addons separated by a |
+# Any subdomains that match the below will only have specific pages protected by Authelia (e.g. /configure). The resources that are protected
+# will work for all the addons in this template, and will protect the pages used to configure the addon while leaving the core addon unprotected, 
+# allowing apps to use the addon.
+# so DO NOT include subdomains for your other apps here, as it would mean those other apps would not have all resources protected by Authelia.
+# If you aren't using any stremio addons, you can set this to a random string that won't match any subdomains.
+STREMIO_ADDON_SUBDOMAINS=aio|aiostremio|comet|easynews|mediafusion|jackettio|stremio-jackett|stremthru|omgtv|stremio-catalogues|stremio-trakt
\ No newline at end of file
diff --git a/apps/authelia/compose.yaml b/apps/authelia/compose.yaml
index 8a7390f..74c5f59 100644
--- a/apps/authelia/compose.yaml
+++ b/apps/authelia/compose.yaml
@@ -4,10 +4,8 @@ services:
     image: 'authelia/authelia'
     restart: 'unless-stopped'
     user: $PUID:$PGID
-    volumes:
-      - '${DOCKER_DATA_DIR}/authelia/config:/config'
     environment:
-      TZ: ${TZ:-UTC}
+      TZ: ${TZ:-Etc/UTC}
       X_AUTHELIA_CONFIG_FILTERS: template
       TEMPLATE_AUTHELIA_SESSION_SECRET: ${AUTHELIA_SESSION_SECRET?}
       TEMPLATE_DOMAIN: ${DOMAIN?}
@@ -15,17 +13,18 @@ services:
       TEMPLATE_AUTHELIA_STORAGE_ENCRYPTION_KEY: ${AUTHELIA_STORAGE_ENCRYPTION_KEY?}
       TEMPLATE_AUTHELIA_WEBAUTHN_DISPLAY_NAME: ${AUTHELIA_WEBAUTHN_DISPLAY_NAME?}
       TEMPLATE_AUTHELIA_JWT_SECRET: ${AUTHELIA_JWT_SECRET?}
+      TEMPLATE_STREMIO_ADDON_SUBDOMAINS: ${STREMIO_ADDON_SUBDOMAINS?}
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.authelia.rule=Host(`${AUTHELIA_SUBDOMAIN?}.${DOMAIN}`)"
       - "traefik.http.routers.authelia.entryPoints=websecure"
       - "traefik.http.routers.authelia.tls.certresolver=letsencrypt"
       - "traefik.http.services.authelia.loadbalancer.server.port=9091"
-
       - "traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/authz/forward-auth"
       - "traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true"
       - "traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Email,Remote-Name"
-
+    volumes:
+      - '${DOCKER_DATA_DIR}/authelia/config:/config'
     depends_on:
       authelia_redis:
         condition: service_healthy
diff --git a/apps/comet/compose.yaml b/apps/comet/compose.yaml
index 4378852..c2ee45d 100644
--- a/apps/comet/compose.yaml
+++ b/apps/comet/compose.yaml
@@ -8,16 +8,17 @@ services:
     env_file:
       - .env
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.comet.rule=Host(`${COMET_HOSTNAME}`)"
-      - "traefik.http.routers.comet.entrypoints=websecure"
-      - "traefik.http.routers.comet.tls.certresolver=letsencrypt"
-      - "flame.type=app"
-      - "flame.name=Comet"
-      - "flame.url=https://${COMET_HOSTNAME}"
+      - traefik.enable=true
+      - traefik.http.routers.comet.rule=Host(`${COMET_HOSTNAME}`)
+      - traefik.http.routers.comet.entrypoints=websecure
+      - traefik.http.routers.comet.tls.certresolver=letsencrypt
+      - traefik.http.routers.comet.middlewares=authelia@docker
+      - flame.type=app
+      - flame.name=Comet
+      - flame.url=https://${COMET_HOSTNAME}
     volumes:
       - ${DOCKER_DATA_DIR}/comet:/app/data
-    healthcheck: 
+    healthcheck:
       test: wget -qO- http://127.0.0.1:2020/health
       interval: 1m
       timeout: 10s
diff --git a/apps/jackettio/compose.yaml b/apps/jackettio/compose.yaml
index 3dee014..d9eea38 100644
--- a/apps/jackettio/compose.yaml
+++ b/apps/jackettio/compose.yaml
@@ -15,6 +15,7 @@ services:
       - "traefik.http.routers.jackettio.rule=Host(`${JACKETTIO_HOSTNAME?}`)"
       - "traefik.http.routers.jackettio.entrypoints=websecure"
       - "traefik.http.routers.jackettio.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.jackettio.middlewares=authelia@docker"
       - "flame.type=app"
       - "flame.name=Jackettio"
       - "flame.url=https://${JACKETTIO_HOSTNAME}"
diff --git a/apps/mediafusion/compose.yaml b/apps/mediafusion/compose.yaml
index f281289..a9de9da 100644
--- a/apps/mediafusion/compose.yaml
+++ b/apps/mediafusion/compose.yaml
@@ -23,6 +23,7 @@ services:
       - "traefik.http.routers.mediafusion.rule=Host(`${MEDIAFUSION_HOSTNAME?}`)"
       - "traefik.http.routers.mediafusion.entrypoints=websecure"
       - "traefik.http.routers.mediafusion.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.mediafusion.middlewares=authelia@docker"
       - "flame.type=app"
       - "flame.name=MediaFusion"
       - "flame.url=https://${MEDIAFUSION_HOSTNAME?}"
diff --git a/apps/omg-tv-addon/compose.yaml b/apps/omg-tv-addon/compose.yaml
index 98d79ff..de04a45 100644
--- a/apps/omg-tv-addon/compose.yaml
+++ b/apps/omg-tv-addon/compose.yaml
@@ -16,6 +16,7 @@ services:
       - "traefik.http.routers.omg-tv-stremio-addon.rule=Host(`${OMG_TV_STREMIO_ADDON_HOSTNAME?}`)"
       - "traefik.http.routers.omg-tv-stremio-addon.entrypoints=websecure"
       - "traefik.http.routers.omg-tv-stremio-addon.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.omg-tv-stremio-addon.middlewares=authelia@docker"
       - "traefik.http.services.omg-tv-stremio-addon.loadbalancer.server.port=7860"
       - "flame.type=app"
       - "flame.name=OMG TV Stremio Addon"
diff --git a/apps/stremio-catalog-providers/compose.yaml b/apps/stremio-catalog-providers/compose.yaml
index 93ae080..90af8c4 100644
--- a/apps/stremio-catalog-providers/compose.yaml
+++ b/apps/stremio-catalog-providers/compose.yaml
@@ -38,6 +38,7 @@ services:
       - "traefik.http.routers.ravenn-catalogs.rule=Host(`${STREMIO_CATALOG_PROVIDERS_HOSTNAME?}`)"
       - "traefik.http.routers.ravenn-catalogs.entrypoints=websecure"
       - "traefik.http.routers.ravenn-catalogs.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.ravenn-catalogs.middlewares=authelia@docker"
       - "flame.type=app"
       - "flame.name=Stremio Catalogs"
       - "flame.url=https://${STREMIO_CATALOG_PROVIDERS_HOSTNAME}"
diff --git a/apps/stremio-jackett/compose.yaml b/apps/stremio-jackett/compose.yaml
index 1a73b58..61516a5 100644
--- a/apps/stremio-jackett/compose.yaml
+++ b/apps/stremio-jackett/compose.yaml
@@ -14,6 +14,7 @@ services:
       - "traefik.http.routers.stremiojackett.rule=Host(`${STREMIO_JACKETT_HOSTNAME?}`)"
       - "traefik.http.routers.stremiojackett.entrypoints=websecure"
       - "traefik.http.routers.stremiojackett.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.stremiojackett.middlewares=authelia@docker"
       - "flame.type=app"
       - "flame.name=Stremio-Jackett"
       - "flame.url=https://${STREMIO_JACKETT_HOSTNAME}"
diff --git a/apps/stremio-trakt-addon/compose.yaml b/apps/stremio-trakt-addon/compose.yaml
index b1d125b..9b60b72 100644
--- a/apps/stremio-trakt-addon/compose.yaml
+++ b/apps/stremio-trakt-addon/compose.yaml
@@ -41,6 +41,7 @@ services:
       - "traefik.http.routers.ravenn-trakt.rule=Host(`${STREMIO_TRAKT_ADDON_HOSTNAME?}`)"
       - "traefik.http.routers.ravenn-trakt.entrypoints=websecure"
       - "traefik.http.routers.ravenn-trakt.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.ravenn-trakt.middlewares=authelia@docker"
       - "flame.type=app"
       - "flame.name=Stremio Trakt"
       - "flame.url=https://${STREMIO_TRAKT_ADDON_HOSTNAME}"
diff --git a/apps/stremthru/compose.yaml b/apps/stremthru/compose.yaml
index 56b88b3..313bc88 100644
--- a/apps/stremthru/compose.yaml
+++ b/apps/stremthru/compose.yaml
@@ -25,6 +25,7 @@ services:
       - "traefik.http.routers.stremthru.rule=Host(`${STREMTHRU_HOSTNAME?}`)"
       - "traefik.http.routers.stremthru.entrypoints=websecure"
       - "traefik.http.routers.stremthru.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.stremthru.middlewares=authelia@docker"
       - "traefik.http.services.stremthru.loadbalancer.server.port=8080"
       - "flame.type=app"
       - "flame.name=StremThru"
diff --git a/apps/tmdb-addon/compose.yaml b/apps/tmdb-addon/compose.yaml
index a67a78b..c0847df 100644
--- a/apps/tmdb-addon/compose.yaml
+++ b/apps/tmdb-addon/compose.yaml
@@ -19,6 +19,7 @@ services:
       - "traefik.http.routers.tmdb.rule=Host(`${TMDB_ADDON_HOSTNAME?}`)"
       - "traefik.http.routers.tmdb.entrypoints=websecure"
       - "traefik.http.routers.tmdb.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.tmdb.middlewares=authelia@docker"
       - "traefik.http.services.tmdb.loadbalancer.server.port=3232"
       - "flame.type=app"
       - "flame.name=TMDB Addon"
diff --git a/data/authelia/config/configuration.yml b/data/authelia/config/configuration.yml
index f46b38b..fc37a36 100644
--- a/data/authelia/config/configuration.yml
+++ b/data/authelia/config/configuration.yml
@@ -720,7 +720,20 @@ access_control:
   default_policy: 'deny'
 
   rules:
-    ## subdomains
+    ## Rules for stremio addon subdomains
+    ## Protect certain pages (e.g /configure) only
+    ## but leave api routes unprotected so apps can use them.
+
+    - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_SUBDOMAINS" }}).{{ env "TEMPLATE_DOMAIN" }}$'
+      resources:
+        - '.*?/configure($|/.*$|\?.*$)'  # rule for prtecting any resource that has the component somewhere in the path
+        - '.*?/(stremio|sidekick|admin|watch)($|\?.*$)' # rule for protecting any resource that ends with the component.
+        - '^/$' # rule for protecting the root path
+      policy: 'two_factor'
+
+    - domain_regex: '^({{ env "TEMPLATE_STREMIO_ADDON_SUBDOMAINS" }}).{{ env "TEMPLATE_DOMAIN" }}$'
+      policy: 'bypass'
+
     - domain: '*.{{ env "TEMPLATE_DOMAIN" }}'
       policy: 'two_factor'