diff --git a/.env.sample b/.env.sample
index 9389641..8e8b10c 100644
--- a/.env.sample
+++ b/.env.sample
@@ -223,5 +223,8 @@ WRITE_TIMEOUT=0s
 #ANUBIS_SERVE_ROBOTS_TXT=true
 #ANUBIS_SLOG_LEVEL=INFO
 
+## Anubis metrics
+#COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml"
+
 ## Enable onion service support
 #ONION_ENABLED=1
diff --git a/README.md b/README.md
index b845d48..35fbcdb 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,9 @@ After deploying these changes, go to each recipe that supports Anubis
 and follow the process there.  **Enabling Anubis here is not enough for
 protection your apps.**
 
+If you want to collect Prometheus metrics for Anubis, for instance with
+[monitoring-ng](/monitoring-ng), uncomment the "Anubis metrics" section.
+
 ## Enabling onion service
 
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).
diff --git a/abra.sh b/abra.sh
index d5c01aa..8c8cb8d 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,3 +1,4 @@
 export TRAEFIK_YML_VERSION=v32
 export FILE_PROVIDER_YML_VERSION=v12
 export ENTRYPOINT_VERSION=v5
+export ANUBIS_YML_VERSION=v1
diff --git a/anubis.yml.tmpl b/anubis.yml.tmpl
new file mode 100644
index 0000000..7526aa9
--- /dev/null
+++ b/anubis.yml.tmpl
@@ -0,0 +1,7 @@
+bots:
+- import: (data)/meta/default-config.yaml
+{{ if eq (env "ANUBIS_METRICS_ENABLED") "true" }}
+metrics:
+  bind: ":9090"
+  network: "tcp"
+{{ end }}
diff --git a/compose.anubis-metrics.yml b/compose.anubis-metrics.yml
new file mode 100644
index 0000000..de5baa7
--- /dev/null
+++ b/compose.anubis-metrics.yml
@@ -0,0 +1,11 @@
+---
+version: "3.8"
+services:
+  anubis:
+    environment:
+      ANUBIS_METRICS_ENABLED: "true"
+    deploy:
+      labels:
+      - "prometheus.io/scrape=true"
+      - "prometheus.io/port=9090"
+      - "prometheus.io/path=/metrics"
diff --git a/compose.anubis.yml b/compose.anubis.yml
index cbb259f..1ff960c 100644
--- a/compose.anubis.yml
+++ b/compose.anubis.yml
@@ -19,6 +19,10 @@ services:
       OG_CACHE_CONSIDER_HOST: "${ANUBIS_OG_CACHE_CONSIDER_HOST}"
       SERVE_ROBOTS_TXT: "${ANUBIS_SERVE_ROBOTS_TXT}"
       SLOG_LEVEL: "${ANUBIS_SLOG_LEVEL:-INFO}"
+      POLICY_FNAME: "/data/cfg/botPolicy.yaml"
+    configs:
+    - source: anubis_yml
+      target: /data/cfg/botPolicy.yaml
     networks:
     - proxy
     deploy:
@@ -29,3 +33,8 @@ services:
       - "traefik.http.routers.anubis.entrypoints=web-secure"
       - "traefik.http.services.anubis.loadbalancer.server.port=8080"
       - "traefik.http.routers.anubis.service=anubis"
+configs:
+  anubis_yml:
+    name: ${STACK_NAME}_anubis_yml_${ANUBIS_YML_VERSION}
+    file: anubis.yml.tmpl
+    template_driver: golang