diff --git a/apps/alloy.yaml b/apps/alloy.yaml
index 3b2d845..b2868ac 100644
--- a/apps/alloy.yaml
+++ b/apps/alloy.yaml
@@ -103,30 +103,30 @@ spec:
                 clustering { enabled = true }
               }
 
-              // ---- cadvisor through the API server proxy (container CPU/memory of namespace demo) ----
+              // ---- cadvisor straight from each kubelet (container CPU/memory of namespace demo) ----
+              // nodes/metrics is in the chart ClusterRole, nodes/proxy is not (checked 2026-10-08), so the kubelet
+              // port is scraped directly; the kubeadm kubelet serving certificate is self-signed, hence insecure_skip_verify.
               discovery.kubernetes "nodes" { role = "node" }
               discovery.relabel "cadvisor" {
                 targets = discovery.kubernetes.nodes.targets
                 rule {
-                  target_label = "__address__"
-                  replacement = "kubernetes.default.svc:443"
-                }
-                rule {
-                  source_labels = ["__meta_kubernetes_node_name"]
-                  regex = "(.+)"
                   target_label = "__metrics_path__"
-                  replacement = "/api/v1/nodes/$1/proxy/metrics/cadvisor"
+                  replacement  = "/metrics/cadvisor"
                 }
                 rule {
                   source_labels = ["__meta_kubernetes_node_name"]
-                  target_label = "node"
+                  target_label  = "node"
+                }
+                rule {
+                  target_label = "job"
+                  replacement  = "cadvisor"
                 }
               }
               prometheus.scrape "cadvisor" {
                 targets           = discovery.relabel.cadvisor.output
                 scheme            = "https"
                 bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
-                tls_config { ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" }
+                tls_config { insecure_skip_verify = true }
                 scrape_interval   = "30s"
                 forward_to        = [prometheus.relabel.cadvisor_keep.receiver]
                 clustering { enabled = true }
@@ -135,18 +135,18 @@ spec:
                 forward_to = [prometheus.remote_write.mimir.receiver]
                 rule {
                   source_labels = ["__name__"]
-                  regex = "container_(cpu_usage_seconds_total|memory_working_set_bytes|oom_events_total|network_receive_bytes_total|network_transmit_bytes_total)"
-                  action = "keep"
+                  regex         = "up|container_(cpu_usage_seconds_total|memory_working_set_bytes|oom_events_total|network_receive_bytes_total|network_transmit_bytes_total)"
+                  action        = "keep"
                 }
                 rule {
-                  source_labels = ["namespace"]
-                  regex = "demo|ingress-nginx|argocd"
-                  action = "keep"
+                  source_labels = ["__name__", "namespace"]
+                  regex         = "container_.*;(demo|ingress-nginx|argocd)"
+                  action        = "keep"
                 }
                 rule {
                   source_labels = ["container"]
-                  regex = "POD|"
-                  action = "drop"
+                  regex         = "POD|"
+                  action        = "drop"
                 }
               }