diff --git a/apps/base/artifactapi/kustomization.yaml b/apps/base/artifactapi/kustomization.yaml
index e338494..8e5a482 100644
--- a/apps/base/artifactapi/kustomization.yaml
+++ b/apps/base/artifactapi/kustomization.yaml
@@ -18,4 +18,5 @@ resources:
   - ui-hpa.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vmpodscrape.yaml
   - vpa.yaml
diff --git a/apps/base/artifactapi/redis-deployment.yaml b/apps/base/artifactapi/redis-deployment.yaml
index 623baf3..4298e18 100644
--- a/apps/base/artifactapi/redis-deployment.yaml
+++ b/apps/base/artifactapi/redis-deployment.yaml
@@ -13,7 +13,6 @@ spec:
     metadata:
       labels:
         app: redis
-        monitoring.unkin.net/redis-exporter: "true"
     spec:
       containers:
         - name: redis
diff --git a/apps/base/artifactapi/vmpodscrape.yaml b/apps/base/artifactapi/vmpodscrape.yaml
new file mode 100644
index 0000000..6e26cea
--- /dev/null
+++ b/apps/base/artifactapi/vmpodscrape.yaml
@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the redis pod. Picked up by the
+# observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the redis Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: redis-exporter
+  namespace: artifactapi
+spec:
+  selector:
+    matchLabels:
+      app: redis
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
diff --git a/apps/base/authentik/kustomization.yaml b/apps/base/authentik/kustomization.yaml
index 173bd5e..fbc2dcf 100644
--- a/apps/base/authentik/kustomization.yaml
+++ b/apps/base/authentik/kustomization.yaml
@@ -18,4 +18,5 @@ resources:
   - redis-service.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vmpodscrape.yaml
   - vpa.yaml
diff --git a/apps/base/authentik/redis-deployment.yaml b/apps/base/authentik/redis-deployment.yaml
index 777bf02..5cc8552 100644
--- a/apps/base/authentik/redis-deployment.yaml
+++ b/apps/base/authentik/redis-deployment.yaml
@@ -15,7 +15,6 @@ spec:
     metadata:
       labels:
         app: redis
-        monitoring.unkin.net/redis-exporter: "true"
     spec:
       containers:
         - name: redis
diff --git a/apps/base/authentik/vmpodscrape.yaml b/apps/base/authentik/vmpodscrape.yaml
new file mode 100644
index 0000000..e20cf0f
--- /dev/null
+++ b/apps/base/authentik/vmpodscrape.yaml
@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the redis pod. Picked up by the
+# observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the redis Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: redis-exporter
+  namespace: authentik
+spec:
+  selector:
+    matchLabels:
+      app: redis
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
diff --git a/apps/base/gitea/kustomization.yaml b/apps/base/gitea/kustomization.yaml
index 03a8b42..d43ae7d 100644
--- a/apps/base/gitea/kustomization.yaml
+++ b/apps/base/gitea/kustomization.yaml
@@ -10,6 +10,7 @@ resources:
   - valkey-deployment.yaml
   - valkey-pvc.yaml
   - valkey-service.yaml
+  - vmpodscrape.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - gateway.yaml
diff --git a/apps/base/gitea/valkey-deployment.yaml b/apps/base/gitea/valkey-deployment.yaml
index 7cb1647..3015036 100644
--- a/apps/base/gitea/valkey-deployment.yaml
+++ b/apps/base/gitea/valkey-deployment.yaml
@@ -27,7 +27,6 @@ spec:
         app: gitea-valkey
         app.kubernetes.io/name: gitea
         app.kubernetes.io/component: valkey
-        monitoring.unkin.net/redis-exporter: "true"
     spec:
       securityContext:
         fsGroup: 999
diff --git a/apps/base/gitea/vmpodscrape.yaml b/apps/base/gitea/vmpodscrape.yaml
new file mode 100644
index 0000000..0f85d19
--- /dev/null
+++ b/apps/base/gitea/vmpodscrape.yaml
@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the gitea-valkey pod. Picked up
+# by the observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the valkey Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: valkey-exporter
+  namespace: gitea
+spec:
+  selector:
+    matchLabels:
+      app: gitea-valkey
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
diff --git a/apps/base/jellyfin/kustomization.yaml b/apps/base/jellyfin/kustomization.yaml
index e1b1262..26efe34 100644
--- a/apps/base/jellyfin/kustomization.yaml
+++ b/apps/base/jellyfin/kustomization.yaml
@@ -21,5 +21,6 @@ resources:
   - pdb.yaml
   - service.yaml
   - valkey.yaml
+  - vmpodscrape.yaml
   - gateway.yaml
   - httproute.yaml
diff --git a/apps/base/jellyfin/valkey.yaml b/apps/base/jellyfin/valkey.yaml
index 23ad378..38a66c8 100644
--- a/apps/base/jellyfin/valkey.yaml
+++ b/apps/base/jellyfin/valkey.yaml
@@ -28,9 +28,8 @@ spec:
   # redis_exporter sidecar (:9121, port name `metrics`) on every ValkeyNode pod;
   # the operator manages a dedicated _exporter ACL user for it. Image overridden
   # from the operator default (bare dockerhub oliver006/redis_exporter:v1.80.0)
-  # to the artifactapi-proxied pin. Scraped by the valkey-operator VMPodScrape in
-  # apps/base/observability (operator pods get fixed labels only, so they need
-  # their own selector rather than monitoring.unkin.net/redis-exporter).
+  # to the artifactapi-proxied pin. Scraped by the valkey-exporter VMPodScrape
+  # in vmpodscrape.yaml alongside this file.
   exporter:
     enabled: true
     image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
diff --git a/apps/base/jellyfin/vmpodscrape.yaml b/apps/base/jellyfin/vmpodscrape.yaml
new file mode 100644
index 0000000..4cf7c67
--- /dev/null
+++ b/apps/base/jellyfin/vmpodscrape.yaml
@@ -0,0 +1,19 @@
+---
+# Scrape the operator-injected redis_exporter sidecar (:9121, port name
+# `metrics`) on the jellyfin-valkey ValkeyNode pods. The valkey-operator gives
+# its pods fixed labels only (no pod-label passthrough on the ValkeyCluster CR),
+# so select on the operator-managed labels. Picked up by the observability
+# VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: valkey-exporter
+  namespace: jellyfin
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/managed-by: valkey-operator
+      app.kubernetes.io/component: valkey-node
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
diff --git a/apps/base/litellm/kustomization.yaml b/apps/base/litellm/kustomization.yaml
index bc8e4b4..4e6a292 100644
--- a/apps/base/litellm/kustomization.yaml
+++ b/apps/base/litellm/kustomization.yaml
@@ -16,6 +16,7 @@ resources:
   - services.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vmpodscrape.yaml
   - vpa.yaml
 
 configMapGenerator:
diff --git a/apps/base/litellm/redis-deployment.yaml b/apps/base/litellm/redis-deployment.yaml
index 3ca1a14..d47597f 100644
--- a/apps/base/litellm/redis-deployment.yaml
+++ b/apps/base/litellm/redis-deployment.yaml
@@ -15,7 +15,6 @@ spec:
     metadata:
       labels:
         app: redis
-        monitoring.unkin.net/redis-exporter: "true"
     spec:
       containers:
         - name: redis
diff --git a/apps/base/litellm/vmpodscrape.yaml b/apps/base/litellm/vmpodscrape.yaml
new file mode 100644
index 0000000..28a20d8
--- /dev/null
+++ b/apps/base/litellm/vmpodscrape.yaml
@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the redis pod. Picked up by the
+# observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the redis Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: redis-exporter
+  namespace: litellm
+spec:
+  selector:
+    matchLabels:
+      app: redis
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
diff --git a/apps/base/netbox/kustomization.yaml b/apps/base/netbox/kustomization.yaml
index 03a8b42..d43ae7d 100644
--- a/apps/base/netbox/kustomization.yaml
+++ b/apps/base/netbox/kustomization.yaml
@@ -10,6 +10,7 @@ resources:
   - valkey-deployment.yaml
   - valkey-pvc.yaml
   - valkey-service.yaml
+  - vmpodscrape.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - gateway.yaml
diff --git a/apps/base/netbox/valkey-deployment.yaml b/apps/base/netbox/valkey-deployment.yaml
index 1efbd71..9070964 100644
--- a/apps/base/netbox/valkey-deployment.yaml
+++ b/apps/base/netbox/valkey-deployment.yaml
@@ -27,7 +27,6 @@ spec:
         app: netbox-valkey
         app.kubernetes.io/name: netbox
         app.kubernetes.io/component: valkey
-        monitoring.unkin.net/redis-exporter: "true"
     spec:
       securityContext:
         fsGroup: 999
diff --git a/apps/base/netbox/vmpodscrape.yaml b/apps/base/netbox/vmpodscrape.yaml
new file mode 100644
index 0000000..67339cb
--- /dev/null
+++ b/apps/base/netbox/vmpodscrape.yaml
@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the netbox-valkey pod. Picked up
+# by the observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the valkey Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: valkey-exporter
+  namespace: netbox
+spec:
+  selector:
+    matchLabels:
+      app: netbox-valkey
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
diff --git a/apps/base/observability/kustomization.yaml b/apps/base/observability/kustomization.yaml
index bcd46cb..53d138e 100644
--- a/apps/base/observability/kustomization.yaml
+++ b/apps/base/observability/kustomization.yaml
@@ -9,5 +9,4 @@ resources:
   - gateway.yaml
   - httproute.yaml
   - vmpodscrape-cnpg.yaml
-  - vmpodscrape-redis.yaml
   - vmpodscrape-traefik.yaml
diff --git a/apps/base/observability/vmpodscrape-redis.yaml b/apps/base/observability/vmpodscrape-redis.yaml
deleted file mode 100644
index 80735c6..0000000
--- a/apps/base/observability/vmpodscrape-redis.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
----
-# Scrape metrics (:9121) from every redis/valkey pod carrying a redis_exporter
-# sidecar in any namespace. Raw redis/valkey Deployments opt in via the
-# monitoring.unkin.net/redis-exporter pod label. Picked up by the observability
-# VMAgent (selectAllByDefault).
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMPodScrape
-metadata:
-  name: redis-exporters
-  namespace: observability
-spec:
-  namespaceSelector:
-    any: true
-  selector:
-    matchLabels:
-      monitoring.unkin.net/redis-exporter: "true"
-  podMetricsEndpoints:
-    - port: metrics
-      path: /metrics
----
-# valkey-operator-managed ValkeyCluster pods (e.g. jellyfin-valkey) get fixed
-# operator labels only -- the ValkeyCluster CR has no pod-label passthrough, so
-# they cannot carry monitoring.unkin.net/redis-exporter and need their own
-# selector. The operator's exporter sidecar also listens on :9121 with a port
-# named `metrics`.
-apiVersion: operator.victoriametrics.com/v1beta1
-kind: VMPodScrape
-metadata:
-  name: valkey-operator-clusters
-  namespace: observability
-spec:
-  namespaceSelector:
-    any: true
-  selector:
-    matchLabels:
-      app.kubernetes.io/managed-by: valkey-operator
-      app.kubernetes.io/component: valkey-node
-  podMetricsEndpoints:
-    - port: metrics
-      path: /metrics