diff --git a/README.md b/README.md
index b33937a..aa44680 100644
--- a/README.md
+++ b/README.md
@@ -1124,6 +1124,7 @@ ansible-playbook content.yml --check --diff   # dry run: reads DNSLink and the p
 |------|----------|----------|
 | 4101 tcp+udp | kubo libp2p (TCP, QUIC, WebTransport, WebRTC-direct) | public |
 | 5021 | kubo RPC API | loopback |
+| 8888 | ipfs-cluster Prometheus metrics (scraped through ipni/infra's metrics proxy) | loopback |
 | 9094 | ipfs-cluster REST API | loopback |
 | 9095 | ipfs-cluster IPFS proxy | loopback |
 | 9096 tcp | ipfs-cluster swarm | the other two boxes only (ufw), and the cluster secret |
diff --git a/k8s/content/deployment.yaml b/k8s/content/deployment.yaml
index 0cdaf55..42115a1 100644
--- a/k8s/content/deployment.yaml
+++ b/k8s/content/deployment.yaml
@@ -5,7 +5,7 @@ metadata:
   name: content
 spec:
   replicas: 1
-  # hostNetwork binds 4101/5021/9094-9096 on the node, so a second pod cannot
+  # hostNetwork binds 4101/5021/8888/9094-9096 on the node, so a second pod cannot
   # start while the old one holds them; Recreate stops the old pod first.
   strategy:
     type: Recreate
@@ -263,6 +263,14 @@ spec:
             - name: CLUSTER_PINSVCAPI_BASICAUTHCREDENTIALS
               valueFrom:
                 secretKeyRef: { name: content-cluster, key: pinsvc-credentials }
+            # Prometheus metrics (pins, pins in error, pin queue) on loopback,
+            # scraped through the metrics proxy in ipni/infra
+            # (kubernetes/platform/metrics-proxy). 8888 is reserved in
+            # group_vars/ipfs_nodes/main.yml.
+            - name: CLUSTER_METRICS_ENABLESTATS
+              value: "true"
+            - name: CLUSTER_METRICS_PROMETHEUSENDPOINT
+              value: /ip4/127.0.0.1/tcp/8888
           ports:
             # roles/content opens 9096/tcp in ufw, to the other boxes only.
             - name: cluster-swarm
diff --git a/roles/content/defaults/main.yml b/roles/content/defaults/main.yml
index 1d922dc..5fac852 100644
--- a/roles/content/defaults/main.yml
+++ b/roles/content/defaults/main.yml
@@ -3,6 +3,7 @@
 # net.ipv4.ip_local_reserved_ports in group_vars/ipfs_nodes/main.yml.
 content_kubo_swarm_port: 4101     # public, TCP + UDP
 content_kubo_api_port: 5021       # loopback
+content_cluster_metrics_port: 8888  # loopback (Prometheus metrics)
 content_cluster_api_port: 9094    # loopback (REST API)
 content_cluster_swarm_port: 9096  # TCP, the other boxes only
 content_pinsvc_port: 9097         # loopback (Pinning Service API, behind Envoy)