diff --git a/AGENTS.md b/AGENTS.md
index 6573355..47d3dfe 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -18,7 +18,7 @@ Repository guide for agentic contributors working in this repo.
 - **cert-manager** is required — Tailscale LoadBalancer does L4 TCP passthrough, so Rancher serves its own TLS.
 - **Secrets flow**: Doppler → `ClusterSecretStore` (doppler-hetznerterra) → `ExternalSecret` resources → k8s Secrets.
 - Rancher is reachable only over Tailscale at `https://rancher.silverside-gopher.ts.net/`.
-- Grafana, Prometheus, and Flux UI are also exposed via dedicated Tailscale LoadBalancer services at `http://grafana.silverside-gopher.ts.net/`, `http://prometheus.silverside-gopher.ts.net/`, `http://flux.silverside-gopher.ts.net:9001/`.
+- Grafana, Prometheus, and Flux UI are also exposed via dedicated Tailscale LoadBalancer services at `http://grafana.silverside-gopher.ts.net/`, `http://prometheus.silverside-gopher.ts.net:9090/`, `http://flux.silverside-gopher.ts.net:9001/`.
 
 ## Important Files
 
diff --git a/infrastructure/addons/observability/helmrelease-kube-prometheus-stack.yaml b/infrastructure/addons/observability/helmrelease-kube-prometheus-stack.yaml
index a364dda..ed069f5 100644
--- a/infrastructure/addons/observability/helmrelease-kube-prometheus-stack.yaml
+++ b/infrastructure/addons/observability/helmrelease-kube-prometheus-stack.yaml
@@ -49,7 +49,7 @@ spec:
       service:
         type: ClusterIP
       prometheusSpec:
-        externalUrl: http://prometheus.silverside-gopher.ts.net/
+        externalUrl: http://prometheus.silverside-gopher.ts.net:9090/
         routePrefix: /
         retention: 7d
         storageSpec: