diff --git a/apps/monitoring/prometheus-deployment.yaml b/apps/monitoring/prometheus-deployment.yaml
new file mode 100644
index 0000000..1010a3a
--- /dev/null
+++ b/apps/monitoring/prometheus-deployment.yaml
@@ -0,0 +1,110 @@
+---
+# Prometheus data volume — RWO on hcloud-volumes-encrypted (fsn1). Because the
+# volume is RWO, the Deployment below must use Recreate; a rolling update would
+# spin up a surge pod that cannot mount the volume while the old pod holds it
+# and the rollout would stall at Init:0/1. See DEV-583 / mirrors DEV-538.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prometheus-data-encrypted
+  namespace: monitoring
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: hcloud-volumes-encrypted
+  resources:
+    requests:
+      storage: 50Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: prometheus
+  namespace: monitoring
+  labels:
+    app: prometheus
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9090
+      targetPort: 9090
+      name: web
+  selector:
+    app: prometheus
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prometheus
+  namespace: monitoring
+  labels:
+    app: prometheus
+spec:
+  replicas: 1
+  # prometheus-data-encrypted is RWO on hcloud-volumes-encrypted, so a rolling
+  # update deadlocks (new pod cannot attach the PVC while the old pod holds
+  # it). Recreate drops the old pod first so the CSI detaches the volume
+  # before the new pod tries to attach it. Same pattern as loki/opencloud.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: prometheus
+  template:
+    metadata:
+      labels:
+        app: prometheus
+      annotations:
+        # Exclude the prometheus TSDB volume from Velero fs-backup — TSDB is
+        # backed up separately by prometheus-backup-cronjob and streaming it
+        # through Kopia would double-copy tens of GiB on every backup.
+        backup.velero.io/backup-volumes-excludes: prometheus-storage
+    spec:
+      serviceAccountName: prometheus
+      initContainers:
+        - name: fix-permissions
+          image: busybox:latest
+          command:
+            - sh
+            - -c
+            - chown -R 65534:65534 /prometheus && chmod -R 755 /prometheus
+          volumeMounts:
+            - name: prometheus-storage
+              mountPath: /prometheus
+      containers:
+        - name: prometheus
+          image: prom/prometheus:v2.47.0
+          args:
+            - '--config.file=/etc/prometheus/prometheus.yml'
+            - '--storage.tsdb.path=/prometheus'
+            - '--storage.tsdb.retention.time=30d'
+            - '--web.console.libraries=/usr/share/prometheus/console_libraries'
+            - '--web.console.templates=/usr/share/prometheus/consoles'
+            - '--web.enable-lifecycle'
+          ports:
+            - containerPort: 9090
+              name: web
+          volumeMounts:
+            - name: prometheus-config
+              mountPath: /etc/prometheus
+            - name: prometheus-rules
+              mountPath: /etc/prometheus/rules
+            - name: prometheus-storage
+              mountPath: /prometheus
+          resources:
+            requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
+              cpu: 1000m
+              memory: 2Gi
+      volumes:
+        - name: prometheus-config
+          configMap:
+            name: prometheus-config
+        - name: prometheus-rules
+          configMap:
+            name: prometheus-rules
+        - name: prometheus-storage
+          persistentVolumeClaim:
+            claimName: prometheus-data-encrypted