diff --git a/kubernetes/apps/monitoring-rules/probes-blackbox.yaml b/kubernetes/apps/monitoring-rules/probes-blackbox.yaml
index 26a93c5d..4c496607 100644
--- a/kubernetes/apps/monitoring-rules/probes-blackbox.yaml
+++ b/kubernetes/apps/monitoring-rules/probes-blackbox.yaml
@@ -21,6 +21,13 @@ spec:
         - https://immich.renner.uno
         - https://auth.renner.uno
         - https://home.renner.uno
+        # prometheus.renner.uno and alerts.renner.uno are Authentik-gated
+        # (PR #147 / #146). These EXTERNAL probes now measure the full
+        # gated path — DNS, TLS, Traefik, the gate outpost — following the
+        # 302 to the Authentik login (200). They are REACHABILITY checks,
+        # not app health: with the gate up, they stay green even if the app
+        # behind it is dead (the probe never reaches the app). Real app
+        # health comes from the two INTERNAL /-/healthy probes below.
         - https://prometheus.renner.uno
         - https://alerts.renner.uno
         - https://dash.renner.uno
@@ -28,6 +35,18 @@ spec:
         # returns 200. CNPG WAL archiving + Velero both depend on it;
         # this probe replaces the old GarageDown signal on nas-1.
         - https://fsn1.your-objectstorage.com
+        # APP-HEALTH probes for the gated monitoring UIs, from the correct
+        # in-cluster vantage (monitoring-vantage-point-rule): the gate is
+        # only on the ingress, so the ClusterIP /-/healthy endpoints are
+        # reachable and unauthenticated in-cluster. These go red when the
+        # app is actually down, regardless of the gate — closing the blind
+        # spot where a dead app behind a live gate showed green. The
+        # blackbox-exporter runs in this namespace, so intra-namespace
+        # reach to :9093/:9090 is allowed. (The legacy srv-host Prometheus
+        # on VLAN 40 cannot reach cluster ClusterIPs, so it keeps only the
+        # external reachability probe above; it is not the health vantage.)
+        - http://kube-prometheus-stack-alertmanager.monitoring.svc.cluster.local:9093/-/healthy
+        - http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090/-/healthy
 # blackbox-tcp probe deleted 2026-05-20 — only target was the legacy
 # postgres-ha keepalived VIP at 10.2.40.135:5432, decommissioned after
 # the authentik DB moved to in-cluster CNPG (ak-pg). Re-introduce a