diff --git a/apps/base/authentik/kustomization.yaml b/apps/base/authentik/kustomization.yaml
index 8aa078a..0752eaf 100644
--- a/apps/base/authentik/kustomization.yaml
+++ b/apps/base/authentik/kustomization.yaml
@@ -19,6 +19,7 @@ resources:
   - redis-deployment.yaml
   - redis-pvc.yaml
   - redis-service.yaml
+  - server-vmpodscrape.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - vmpodscrape.yaml
diff --git a/apps/base/authentik/server-vmpodscrape.yaml b/apps/base/authentik/server-vmpodscrape.yaml
new file mode 100644
index 0000000..93ed3f2
--- /dev/null
+++ b/apps/base/authentik/server-vmpodscrape.yaml
@@ -0,0 +1,16 @@
+---
+# Scrape the authentik server's django_prometheus endpoint (:9300). Picked up
+# by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: authentik-server
+  namespace: authentik
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/component: server
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics