diff --git a/kubernetes/apps/monitoring-rules/prometheusrule-external-secrets.yaml b/kubernetes/apps/monitoring-rules/prometheusrule-external-secrets.yaml
index 46674175..8a818212 100644
--- a/kubernetes/apps/monitoring-rules/prometheusrule-external-secrets.yaml
+++ b/kubernetes/apps/monitoring-rules/prometheusrule-external-secrets.yaml
@@ -63,6 +63,21 @@ spec:
   groups:
     - name: external-secrets.rules
       rules:
+        # Measured against the live Prometheus before this rule was proposed for
+        # merge, through the apiserver services/proxy read path:
+        #
+        #   count(externalsecret_status_condition)                       = 105
+        #   count(count by (exported_namespace,name) (...))              =  53
+        #   count(count by (exported_namespace,name) (...{condition="Ready"})) = 52
+        #   count(count by (exported_namespace) (...))                   =  20
+        #   count(...{condition="Ready",status="False"})                 =  52
+        #   the ExternalSecretSyncFailing expression below                = EMPTY
+        #
+        # So 105 = 52 ExternalSecrets x 2 Ready polarities + 1 Deleted tombstone,
+        # across 20 namespaces, and THIS RULE ARRIVES SILENT: it matches nothing
+        # in the cluster as it stands, which is what makes it safe to load. The
+        # 52 on the line below is a count, not an estimate.
+        #
         # `== 1` IS LOAD-BEARING, not defensive. ESO writes BOTH polarities of the
         # Ready condition on every reconcile — the true one at 1 and the opposite
         # at 0 (esmetrics.UpdateExternalSecretCondition) — so