diff --git a/deploy/lab/k8s/observability.yaml b/deploy/lab/k8s/observability.yaml
index 499d2e2..d23202f 100644
--- a/deploy/lab/k8s/observability.yaml
+++ b/deploy/lab/k8s/observability.yaml
@@ -33,7 +33,12 @@ metadata:
   name: prometheus
 rules:
   - apiGroups: [""]
-    resources: [nodes, nodes/metrics, services, endpoints, pods]
+    # nodes/proxy is required in addition to nodes/metrics: the kubelet job
+    # reaches each node through the API server's proxy subresource
+    # (/api/v1/nodes/<name>/proxy/metrics). Without it every kubelet target
+    # fails with 403 Forbidden while the other jobs stay green — a partial
+    # failure that is easy to miss unless the target list is checked.
+    resources: [nodes, nodes/metrics, nodes/proxy, services, endpoints, pods]
     verbs: [get, list, watch]
   - nonResourceURLs: ["/metrics"]
     verbs: [get]