diff --git a/apps/base/observability/vmagent.yaml b/apps/base/observability/vmagent.yaml
index d1c4d62..efe229c 100644
--- a/apps/base/observability/vmagent.yaml
+++ b/apps/base/observability/vmagent.yaml
@@ -99,6 +99,10 @@ spec:
       consul_sd_configs:
         - server: consul.service.consul:443
           scheme: https
+          # Set datacenter explicitly so VM does not call /v1/agent/self
+          # (which needs agent:read that the anonymous token lacks); catalog
+          # and health reads work anonymously.
+          datacenter: au-syd1
           tls_config:
             ca_file: /etc/vmagent-tls/ca.crt
       relabel_configs: