diff --git a/.env.sample b/.env.sample
index 0f394c6..97ea814 100644
--- a/.env.sample
+++ b/.env.sample
@@ -222,6 +222,8 @@ WRITE_TIMEOUT=0s
 #ANUBIS_OG_CACHE_CONSIDER_HOST=true
 #ANUBIS_SERVE_ROBOTS_TXT=true
 #ANUBIS_SLOG_LEVEL=INFO
+
+## Anubis metrics
 #COMPOSE_FILE="$COMPOSE_FILE:compose.anubis-metrics.yml"
 #SECRET_BASIC_AUTH_VERSION=v1
 
diff --git a/README.md b/README.md
index b845d48..f6485c3 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,11 @@ After deploying these changes, go to each recipe that supports Anubis
 and follow the process there.  **Enabling Anubis here is not enough for
 protection your apps.**
 
+If you want to collect Prometheus metrics for Anubis, for instance with
+[monitoring-ng](/monitoring-ng), uncomment the "Anubis metrics" section
+and insert the basic auth password as a secret.  The username will be
+"admin".
+
 ## Enabling onion service
 
 Uncomment the line in the config setting `ONION_ENABLED=1`. This will create a new entrypoint on port 9052 which can be used to bypass forced SSL. For more details, see the [onion recipe](https://recipes.coopcloud.tech/onion).