diff --git a/apps/wave-1/sonarr.yaml b/apps/wave-1/sonarr.yaml
index 4d87ac5..f199d47 100644
--- a/apps/wave-1/sonarr.yaml
+++ b/apps/wave-1/sonarr.yaml
@@ -122,7 +122,7 @@ spec:
     spec:
       containers:
       - name: sonarr
-        image: lscr.io/linuxserver/sonarr:4.0.15
+        image: lscr.io/linuxserver/sonarr:4.0.20
         ports:
         - containerPort: 8989
         env:
diff --git a/catalog/sonarr.yaml b/catalog/sonarr.yaml
index c4f6236..2cbfa29 100644
--- a/catalog/sonarr.yaml
+++ b/catalog/sonarr.yaml
@@ -8,7 +8,7 @@
 name: sonarr
 kind: container
 source:
-  image: lscr.io/linuxserver/sonarr:4.0.15   # pinned stable v4 tag (R-UPD-01); update.range governs advancement
+  image: lscr.io/linuxserver/sonarr:4.0.20   # pinned stable v4 tag (R-UPD-01); update.range governs advancement
 # LinuxServer images run their service as the user `abc`, whose uid/gid these two set. They are
 # LOAD-BEARING for the bulk mount, not cosmetic: see the storage note below. The default is 911,
 # which cannot write a 1000:3000-owned 0755 tree.