diff --git a/terraform/vault/approle.tf b/terraform/vault/approle.tf
index a88dfef..ec0d6df 100644
--- a/terraform/vault/approle.tf
+++ b/terraform/vault/approle.tf
@@ -60,6 +60,7 @@ locals {
         "secret/data/hosts/monitoring01/*",
         "secret/data/shared/backup/*",
         "secret/data/shared/nats/*",
+        "secret/data/services/exportarr/*",
       ]
       extra_policies = ["prometheus-metrics"]
     }
diff --git a/terraform/vault/secrets.tf b/terraform/vault/secrets.tf
index d27de3d..1bb8926 100644
--- a/terraform/vault/secrets.tf
+++ b/terraform/vault/secrets.tf
@@ -126,6 +126,17 @@ locals {
       auto_generate = false
       data          = { nkey = var.nixos_exporter_nkey }
     }
+
+    # Exportarr API keys for media stack monitoring
+    "services/exportarr/radarr" = {
+      auto_generate = false
+      data          = { api_key = var.radarr_api_key }
+    }
+
+    "services/exportarr/sonarr" = {
+      auto_generate = false
+      data          = { api_key = var.sonarr_api_key }
+    }
   }
 }
 
diff --git a/terraform/vault/variables.tf b/terraform/vault/variables.tf
index 928abd6..3a03b66 100644
--- a/terraform/vault/variables.tf
+++ b/terraform/vault/variables.tf
@@ -80,3 +80,17 @@ variable "nixos_exporter_nkey" {
   sensitive   = true
 }
 
+variable "radarr_api_key" {
+  description = "Radarr API key for exportarr metrics"
+  type        = string
+  default     = "PLACEHOLDER"
+  sensitive   = true
+}
+
+variable "sonarr_api_key" {
+  description = "Sonarr API key for exportarr metrics"
+  type        = string
+  default     = "PLACEHOLDER"
+  sensitive   = true
+}
+