diff --git a/backend/src/main/java/org/raddatz/familienarchiv/FamilienarchivApplication.java b/backend/src/main/java/org/raddatz/familienarchiv/FamilienarchivApplication.java
index 4fef338f..09227d27 100644
--- a/backend/src/main/java/org/raddatz/familienarchiv/FamilienarchivApplication.java
+++ b/backend/src/main/java/org/raddatz/familienarchiv/FamilienarchivApplication.java
@@ -1,9 +1,11 @@
 package org.raddatz.familienarchiv;
 
 import org.springframework.boot.SpringApplication;
+import org.springframework.boot.actuate.autoconfigure.security.servlet.ManagementWebSecurityAutoConfiguration;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 
-@SpringBootApplication
+// Excluded: management port (8081) is network-isolated inside archiv-net; no app-level auth needed.
+@SpringBootApplication(exclude = {ManagementWebSecurityAutoConfiguration.class})
 public class FamilienarchivApplication {
 
 	public static void main(String[] args) {
diff --git a/infra/observability/prometheus/prometheus.yml b/infra/observability/prometheus/prometheus.yml
index 38a0f8d6..a29cc75b 100644
--- a/infra/observability/prometheus/prometheus.yml
+++ b/infra/observability/prometheus/prometheus.yml
@@ -15,8 +15,6 @@ scrape_configs:
     metrics_path: /actuator/prometheus
     static_configs:
       # Uses the Docker service name (not container_name) for reliable DNS resolution.
-      # Target will show as DOWN until backend instrumentation issue adds
-      # micrometer-registry-prometheus and exposes the endpoint — this is expected.
       - targets: ['backend:8081']
 
   - job_name: ocr-service
diff --git a/infra/observability/promtail/promtail-config.yml b/infra/observability/promtail/promtail-config.yml
index b569c22f..b31781a4 100644
--- a/infra/observability/promtail/promtail-config.yml
+++ b/infra/observability/promtail/promtail-config.yml
@@ -28,3 +28,5 @@ scrape_configs:
         target_label: 'compose_project'
       - source_labels: ['__meta_docker_container_log_stream']
         target_label: 'logstream'
+      - source_labels: ['__meta_docker_container_label_com_docker_compose_service']
+        target_label: 'job'