diff --git a/src/main/java/io/github/opensabre/authorization/config/WebSecurityConfig.java b/src/main/java/io/github/opensabre/authorization/config/WebSecurityConfig.java
index 0f53217..2ccef72 100644
--- a/src/main/java/io/github/opensabre/authorization/config/WebSecurityConfig.java
+++ b/src/main/java/io/github/opensabre/authorization/config/WebSecurityConfig.java
@@ -74,6 +74,10 @@ public SecurityFilterChain defaultSecurityFilterChain(
                         .permitAll()
                         .requestMatchers("/actuator/internalTokenKeyStatus")
                         .permitAll()
+                        // The management port is private to the deployment network. Only the
+                        // aggregate scrape endpoint is exposed to Prometheus without a user token.
+                        .requestMatchers("/actuator/prometheus")
+                        .permitAll()
                         .requestMatchers(ActuatorMonitoringAccess.metricPathArray())
                         .hasAuthority(ActuatorMonitoringAccess.AUTHORITY)
                         .requestMatchers(