diff --git a/.templates/00-global_var.sh b/.templates/00-global_var.sh
index ca6fee0e4..6e3511037 100755
--- a/.templates/00-global_var.sh
+++ b/.templates/00-global_var.sh
@@ -234,7 +234,7 @@ cp "$ENV_FILE" "$ETC_ENV_FILE"
 ################################################################################
 # Inject into scripts and shells (best-effort)
 ################################################################################
-for f in /etc/services.d/*/run /etc/cont-init.d/*.sh /entrypoint.sh /etc/bash.bashrc "${GLOBAL_VAR_FILES:-}"; do
+for f in /etc/services.d/*/run /etc/s6-overlay/s6-rc.d/*/run /etc/cont-init.d/*.sh /entrypoint.sh /etc/bash.bashrc "${GLOBAL_VAR_FILES:-}"; do
     [[ -f "$f" ]] && inject_block "$f"
 done
 
diff --git a/unpackerr/rootfs/etc/cont-init.d/90-vpn.sh b/unpackerr/rootfs/etc/cont-init.d/90-vpn.sh
index 0a31771de..2b4a52277 100755
--- a/unpackerr/rootfs/etc/cont-init.d/90-vpn.sh
+++ b/unpackerr/rootfs/etc/cont-init.d/90-vpn.sh
@@ -23,5 +23,12 @@ case "$VPN_PROVIDER" in
         sed -i "1a sleep infinity" /etc/s6*/s6*/service-privoxy/run
         sed -i "1a sleep infinity" /etc/s6*/s6*/service-proton/run
         sed -i "1a sleep infinity" /etc/s6*/s6*/service-pia/run
+        sed -i "1a sleep infinity" /etc/s6*/s6*/service-forwarder/run
         ;;
 esac
+
+# Disable port forwarder when VPN_AUTO_PORT_FORWARD is explicitly false
+VPN_AUTO_PORT_FORWARD="${VPN_AUTO_PORT_FORWARD:-}"
+if [ "${VPN_AUTO_PORT_FORWARD,,}" = "false" ]; then
+    sed -i "1a sleep infinity" /etc/s6*/s6*/service-forwarder/run 2>/dev/null || true
+fi