diff --git a/modules/blocks/lldap.nix b/modules/blocks/lldap.nix
index 3c3e231..96f4c31 100644
--- a/modules/blocks/lldap.nix
+++ b/modules/blocks/lldap.nix
@@ -304,6 +304,9 @@ in
     };
   };
 
+  imports = [
+    (lib.mkRenamedOptionModule [ "shb" "ldap" ] [ "shb" "lldap" ])
+  ];
   
   config = lib.mkIf cfg.enable {
 
diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix
index 17739fa..2aa8da0 100644
--- a/modules/services/forgejo.nix
+++ b/modules/services/forgejo.nix
@@ -346,6 +346,18 @@ in
     };
   };
 
+  imports = [
+    (lib.mkRemovedOptionModule [ "shb" "forgejo" "adminPassword" ] ''Instead, define an admin user in shb.forgejo.users and give it the same password, like so:
+      shb.forgejo.users = {
+        "forgejoadmin" = {
+          isAdmin = true;
+          email = "forgejoadmin@example.com";
+          password.result = <path/to/password>;
+        };
+      };
+    '')
+  ];
+
   config = mkMerge [
     (mkIf cfg.enable {
       services.forgejo = {
diff --git a/modules/services/jellyfin.nix b/modules/services/jellyfin.nix
index a493785..44aad44 100644
--- a/modules/services/jellyfin.nix
+++ b/modules/services/jellyfin.nix
@@ -91,6 +91,7 @@ in
 
     admin = lib.mkOption {
       description = "Default admin user info. Only needed if LDAP or SSO is not configured.";
+      default = null;
       type = types.nullOr (types.submodule {
         options = {
           username = lib.mkOption {
@@ -253,7 +254,18 @@ in
     };
   };
 
+  imports = [
+    (lib.mkRenamedOptionModule [ "shb" "jellyfin" "adminPassword" ] [ "shb" "jellyfin" "admin" "password" ])
+  ];
+
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = (!cfg.ldap.enable && !cfg.sso.enable) -> cfg.admin != null;
+        message = "Jellyfin admin user must be configured with shb.jellyfin.admin if LDAP or SSO integration are not configured.";
+      }
+    ];
+
     services.jellyfin.enable = true;
 
     networking.firewall = {