diff --git a/vm/observability/apply.sh b/vm/observability/apply.sh
index a9a73c7..08c9123 100755
--- a/vm/observability/apply.sh
+++ b/vm/observability/apply.sh
@@ -12,6 +12,8 @@ unset TOKEN
 ENV_FILE=/opt/selfheal/observability.env
 umask 077; printf 'GF_SECURITY_ADMIN_PASSWORD=%s\n' "$PW" > "$ENV_FILE"; unset PW
 docker compose --env-file "$ENV_FILE" -f compose.yaml up -d --pull always --remove-orphans
+# Grafana reads provisioning files only at start-up; recreate it so datasource/alerting changes apply (state lives in the volume)
+docker compose --env-file "$ENV_FILE" -f compose.yaml up -d --force-recreate --no-deps grafana
 for i in $(seq 1 30); do
   m=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:9009/ready); l=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3100/ready)
   t=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3200/ready); g=$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/api/health)