diff --git a/Dockerfile b/Dockerfile
index dda1d3e09..63340efd0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -71,5 +71,5 @@ USER rails:rails
 ENTRYPOINT ["/rails/bin/docker-entrypoint"]
 
 # Start the server by default, this can be overwritten at runtime
-EXPOSE 80 443
+EXPOSE 80 443 9394
 CMD ["./bin/thrust", "./bin/rails", "server"]
diff --git a/Gemfile b/Gemfile
index 6b9ef6bf2..8e9261196 100644
--- a/Gemfile
+++ b/Gemfile
@@ -42,6 +42,7 @@ gem "rails_structured_logging", bc: "rails-structured-logging"
 gem "yabeda"
 gem "yabeda-rails"
 gem "yabeda-puma-plugin"
+gem "webrick" # required for yabeda-prometheus metrics server
 gem "yabeda-prometheus-mmap"
 gem "prometheus-client-mmap", "~> 1.1"
 
diff --git a/Gemfile.lock b/Gemfile.lock
index e15695962..d5ea57eee 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -615,6 +615,7 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
+    webrick (1.9.1)
     websocket (1.2.11)
     websocket-driver (0.8.0)
       base64
@@ -701,6 +702,7 @@ DEPENDENCIES
   vcr
   web-push
   webmock
+  webrick
   yabeda
   yabeda-prometheus-mmap
   yabeda-puma-plugin
diff --git a/config/deploy.yml b/config/deploy.yml
index 19e9649ea..87c67950a 100644
--- a/config/deploy.yml
+++ b/config/deploy.yml
@@ -32,3 +32,17 @@ aliases:
   console: app exec -i --reuse "bin/rails console"
   ssh: app exec -i --reuse /bin/bash
   switch: accessory exec beamer --reuse "beamer switch --primary=<%= ENV["PRIMARY"] %>"
+
+accessories:
+  otel_collector:
+    image: otel/opentelemetry-collector-contrib:0.126.0
+    port: 9394
+    files:
+      - config/otel_collector.yml:/etc/otelcol-contrib/config.yaml
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    options:
+      user: 0
+    roles:
+      - web
+      - jobs
diff --git a/config/otel_collector.yml b/config/otel_collector.yml
new file mode 100644
index 000000000..4e1ac5ead
--- /dev/null
+++ b/config/otel_collector.yml
@@ -0,0 +1,45 @@
+receivers:
+  prometheus:
+    config:
+      scrape_configs:
+        - job_name: "kamal-containers"
+          scrape_interval: 5s
+          docker_sd_configs:
+            - host: unix:///var/run/docker.sock
+              refresh_interval: 10s
+          relabel_configs:
+            # Limit scraping to labeled containers with port 9394 exposed
+            - source_labels: [__address__]
+              regex: .*:9394
+              action: keep
+            - source_labels: [__meta_docker_container_name]
+              regex: (/fizzy-(web|jobs)-.*|/kamal-proxy)
+              action: keep
+
+            # Pull service and role from Kamal Docker labels
+            - source_labels: [__meta_docker_container_label_service]
+              target_label: service
+            - source_labels: [__meta_docker_container_label_role]
+              target_label: role
+
+            - source_labels: [__meta_docker_container_name]
+              regex: ^/kamal-proxy$
+              target_label: service
+              replacement: kamal-proxy
+            - source_labels: [__meta_docker_container_name]
+              regex: ^/kamal-proxy$
+              target_label: role
+              replacement: proxy
+
+exporters:
+  prometheus:
+    endpoint: 0.0.0.0:9394
+
+service:
+  telemetry:
+    logs:
+      level: "info"
+  pipelines:
+    metrics:
+      receivers: [prometheus]
+      exporters: [prometheus]