diff --git a/deploy-k3s/scripts/03-deploy.sh b/deploy-k3s/scripts/03-deploy.sh
index 1547a45..0f03e2e 100755
--- a/deploy-k3s/scripts/03-deploy.sh
+++ b/deploy-k3s/scripts/03-deploy.sh
@@ -160,6 +160,18 @@ if [[ -d "${MANIFESTS}/web" ]]; then
   kubectl apply -f "${MANIFESTS}/web/service.yaml"
 fi
 
+# Observability — vmagent scrapes api Pods :8000/metrics and remote-writes
+# to obs.88oakapps.com. The bearer token comes from deploy/prod.env so it
+# stays out of the repo; the manifest holds TOKEN_PLACEHOLDER.
+if [[ -d "${MANIFESTS}/observability" ]]; then
+  OBS_TOKEN="$(grep -E '^OBS_INGEST_TOKEN=' "${DEPLOY_DIR}/prod.env" 2>/dev/null | cut -d= -f2- || true)"
+  if [[ -z "${OBS_TOKEN}" ]]; then
+    warn "OBS_INGEST_TOKEN not found in deploy/prod.env — skipping vmagent apply"
+  else
+    sed "s|TOKEN_PLACEHOLDER|${OBS_TOKEN}|" "${MANIFESTS}/observability/vmagent.yaml" | kubectl apply -f -
+  fi
+fi
+
 # --- Wait for rollouts ---
 
 log "Waiting for rollouts..."
@@ -171,6 +183,9 @@ kubectl rollout status deployment/admin -n "${NAMESPACE}" --timeout=300s
 if [[ -d "${MANIFESTS}/web" ]]; then
   kubectl rollout status deployment/web -n "${NAMESPACE}" --timeout=300s
 fi
+if kubectl -n "${NAMESPACE}" get deployment vmagent >/dev/null 2>&1; then
+  kubectl rollout status deployment/vmagent -n "${NAMESPACE}" --timeout=120s
+fi
 
 # --- Done ---