diff --git a/services/authentik/docker-compose.yml b/services/authentik/docker-compose.yml
index ba9f967..3e04818 100644
--- a/services/authentik/docker-compose.yml
+++ b/services/authentik/docker-compose.yml
@@ -16,7 +16,7 @@ volumes:
     name: authentik-certs
 
 x-authentik: &x-authentik
-  image: ghcr.io/goauthentik/server:2024.6.1
+  image: ghcr.io/goauthentik/server:2024.6.3
   restart: unless-stopped
   env_file:
     - .env
diff --git a/services/immich/.env.template b/services/immich/.env.template
index ec87c77..e28c12f 100644
--- a/services/immich/.env.template
+++ b/services/immich/.env.template
@@ -9,4 +9,4 @@ DB_DATABASE_NAME=immich
 REDIS_HOSTNAME=redis
 EXTERNAL_HOST=immich.togetherdays.cz
 
-IMMICH_VERSION=v1.111.0
+IMMICH_VERSION=v1.112.1
diff --git a/services/paperless/.env.template b/services/paperless/.env.template
new file mode 100644
index 0000000..c109819
--- /dev/null
+++ b/services/paperless/.env.template
@@ -0,0 +1,18 @@
+HOST=paperless.togetherdays.cz
+STORAGE_LOCATION=/mnt/data/paperless
+
+PAPERLESS_OCR_LANGUAGES=ces
+
+PAPERLESS_URL=https://paperless.togetherdays.cz
+PAPERLESS_SECRET_KEY={{ password['e7f5a3f2-fd54-463f-963e-135a85e1e0d6'] }}
+PAPERLESS_TIME_ZONE=Europe/Prague
+PAPERLESS_OCR_LANGUAGE=ces
+
+PAPERLESS_DBHOST=db
+PAPERLESS_DBNAME=paperless
+PAPERLESS_DBUSER={{ username['2ac172cf-01bf-4f76-b78a-5a0fb80d9a1c'] }}
+PAPERLESS_DBPASS={{ password['2ac172cf-01bf-4f76-b78a-5a0fb80d9a1c'] }}
+PAPERLESS_REDIS=redis://redis:6379
+
+PAPERLESS_USE_X_FORWARD_HOST=true
+PAPERLESS_USE_X_FORWARD_PORT=true
diff --git a/services/paperless/docker-compose.yml b/services/paperless/docker-compose.yml
new file mode 100644
index 0000000..70188ad
--- /dev/null
+++ b/services/paperless/docker-compose.yml
@@ -0,0 +1,52 @@
+networks:
+  traefik-net:
+    external: true
+    name: traefik-net
+
+x-traefik: &x-traefik
+  networks:
+    - traefik-net
+    - default
+
+volumes:
+  redis-data:
+    name: redis-data
+  paperless-database-data:
+    name: paperless-database-data
+
+services:
+  redis:
+    image: docker.io/library/redis:7
+    volumes:
+      - redis-data:/data
+
+  db:
+    image: docker.io/library/postgres:16
+    volumes:
+      - paperless-database-data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_DB: ${PAPERLESS_DBNAME}
+      POSTGRES_USER: ${PAPERLESS_DBUSER}
+      POSTGRES_PASSWORD: ${PAPERLESS_DBPASS}
+
+  paperless:
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    depends_on:
+      - db
+      - redis
+    volumes:
+      - ${STORAGE_LOCATION}/data:/usr/src/paperless/data
+      - ${STORAGE_LOCATION}/media:/usr/src/paperless/media
+      - ${STORAGE_LOCATION}/export:/usr/src/paperless/export
+      - ${STORAGE_LOCATION}/consume:/usr/src/paperless/consume
+    env_file:
+      - .env
+    <<: *x-traefik
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.docker.network=traefik-net
+        - traefik.http.routers.immich.rule=Host(`${HOST}`)
+        - traefik.http.routers.immich.entrypoints=${ENTRYPOINTS:-websecure}
+        - traefik.http.routers.immich.tls.certresolver=le
+        - traefik.http.services.immich.loadbalancer.server.port=8000