diff --git a/.env.sample b/.env.sample
index 8e8b10c..ffc2ac7 100644
--- a/.env.sample
+++ b/.env.sample
@@ -139,10 +139,14 @@ WRITE_TIMEOUT=0s
 #####################################################################
 
 ## Enable prometheus metrics collection
-## used used by the coop-cloud monitoring stack
-## BASIC_AUTH should also be enabled
+## Metrics are served unauthenticated on :8082, reachable only from
+## other services on the proxy network (e.g. monitoring-ng's Alloy,
+## which auto-discovers it via the prometheus.io/scrape label)
 #COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"
 #METRICS_ENABLED=1
+
+## Setting METRICS_FQDN also adds a public metrics endpoint (behind
+## basic auth). BASIC_AUTH should be enabled for this.
 #METRICS_FQDN=metrics.traefik.example.com
 
 #####################################################################
diff --git a/abra.sh b/abra.sh
index 8c8cb8d..5993f0d 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,4 +1,4 @@
-export TRAEFIK_YML_VERSION=v32
-export FILE_PROVIDER_YML_VERSION=v12
+export TRAEFIK_YML_VERSION=v33
+export FILE_PROVIDER_YML_VERSION=v13
 export ENTRYPOINT_VERSION=v5
 export ANUBIS_YML_VERSION=v1
diff --git a/compose.metrics.yml b/compose.metrics.yml
index f014fe8..ec518cc 100644
--- a/compose.metrics.yml
+++ b/compose.metrics.yml
@@ -3,3 +3,9 @@ services:
   app:
     environment:
       - METRICS_ENABLED
+    deploy:
+      labels:
+        # lets monitoring-ng's Alloy auto-discover and scrape metrics-internal
+        # via the proxy network.
+        - "prometheus.io/scrape=true"
+        - "prometheus.io/port=8082"
diff --git a/file-provider.yml.tmpl b/file-provider.yml.tmpl
index 6bab128..c0fab18 100644
--- a/file-provider.yml.tmpl
+++ b/file-provider.yml.tmpl
@@ -32,6 +32,7 @@ http:
         stsSeconds: "31536000"
   {{ if eq (env "METRICS_ENABLED") "1" }}
   routers:
+    {{ if ne (env "METRICS_FQDN") "" }}
     traefik-metrics:
       rule: "Host(`{{ env "METRICS_FQDN" }}`)"
       entrypoints:
@@ -41,6 +42,14 @@ http:
       middlewares:
         - basicauth@file
       service: prometheus@internal
+    {{ end }}
+    # reachable from other services on the proxy network only (this port
+    # isn't published to the host), without auth
+    traefik-metrics-internal:
+      rule: "PathPrefix(`/`)"
+      entrypoints:
+        - metrics-internal
+      service: prometheus@internal
   {{ end }}
 
 tls:
diff --git a/release/next b/release/next
new file mode 100644
index 0000000..e614378
--- /dev/null
+++ b/release/next
@@ -0,0 +1 @@
+1. compose.metrics.yml now adds prometheus.io/scrape labels so services like monitoring-ng can automatically discover and scrape Traefik's metrics.
diff --git a/traefik.yml.tmpl b/traefik.yml.tmpl
index 28277b9..f970006 100644
--- a/traefik.yml.tmpl
+++ b/traefik.yml.tmpl
@@ -112,6 +112,10 @@ entrypoints:
   onion:
     address: ":9052"
   {{- end }}
+  {{- if eq (env "METRICS_ENABLED") "1" }}
+  metrics-internal:
+    address: ":8082"
+  {{- end }}
 
 ping:
   entryPoint: web