diff --git a/ansible/playbooks/day2_install_node_exporter.yml b/ansible/playbooks/day2_install_node_exporter.yml
new file mode 100644
index 0000000..535edb3
--- /dev/null
+++ b/ansible/playbooks/day2_install_node_exporter.yml
@@ -0,0 +1,80 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: ansible/playbooks/day2_install_node_exporter.yml
+# DESCRIPTION: Install and configure Prometheus Node Exporter on Linux hosts.
+#
+# Targets two groups with different firewall managers:
+#   - proxmox_nodes  : Proxmox hypervisors (Debian, firewalld not present,
+#                      uses iptables/no firewall — just open the port via UFW
+#                      if present, otherwise skip)
+#   - monitored_vms  : Ubuntu VMs managed by UFW
+#
+# After installing on new hosts, re-runs day1_deploy_monitoring.yml to refresh
+# the Prometheus scrape config is NOT needed — targets are already statically
+# defined in prometheus.yaml.j2 for the Proxmox nodes. For new VMs, add the
+# IP to the prometheus.yaml.j2 proxmox-vms job and re-run day1_deploy_monitoring.yml.
+#
+# Usage:
+#   ansible-playbook -i inventory.yml playbooks/day2_install_node_exporter.yml
+#   ansible-playbook -i inventory.yml playbooks/day2_install_node_exporter.yml --limit proxmox_nodes
+#   ansible-playbook -i inventory.yml playbooks/day2_install_node_exporter.yml --limit monitored_vms
+# ------------------------------------------------------------------------------
+
+# ── Play 1: Proxmox hypervisors ───────────────────────────────────────────────
+# Proxmox runs Debian. The prometheus.prometheus.node_exporter role installs
+# a binary + systemd service without touching apt, which is what we want on
+# hypervisors (keep the package footprint clean).
+# Note: Proxmox does not run UFW. Port 9100 is open by default on VLAN 71.
+
+- name: Install Node Exporter on Proxmox hypervisors
+  hosts: proxmox_nodes
+  become: true
+
+  vars:
+    node_exporter_version: "1.9.1"
+    node_exporter_web_listen_address: "0.0.0.0:9100"
+    node_exporter_enabled_collectors:
+      - systemd
+      - processes
+      - filesystem
+      - meminfo
+      - cpu
+      - diskstats
+      - netdev
+      - loadavg
+      - uname
+
+  roles:
+    - role: prometheus.prometheus.node_exporter
+
+# ── Play 2: Ubuntu VMs ────────────────────────────────────────────────────────
+# Standard Ubuntu hosts with UFW. Same role, adds UFW allow rule for 9100.
+
+- name: Install Node Exporter on monitored VMs
+  hosts: monitored_vms
+  become: true
+
+  vars:
+    node_exporter_version: "1.9.1"
+    node_exporter_web_listen_address: "0.0.0.0:9100"
+    node_exporter_enabled_collectors:
+      - systemd
+      - processes
+      - filesystem
+      - meminfo
+      - cpu
+      - diskstats
+      - netdev
+      - loadavg
+      - uname
+
+  pre_tasks:
+    - name: Open Node Exporter port in UFW
+      community.general.ufw:
+        rule: allow
+        port: "9100"
+        proto: tcp
+        comment: "Prometheus Node Exporter"
+
+  roles:
+    - role: prometheus.prometheus.node_exporter
diff --git a/cluster/applications/monitoring/dashboards.yaml b/cluster/applications/monitoring/dashboards.yaml
new file mode 100644
index 0000000..9a40c01
--- /dev/null
+++ b/cluster/applications/monitoring/dashboards.yaml
@@ -0,0 +1,31 @@
+# ------------------------------------------------------------------------------
+# FILE: cluster/applications/monitoring/dashboards.yaml
+# DESCRIPTION: Custom Grafana dashboards as ConfigMaps.
+#              Picked up automatically by the Grafana sidecar via label:
+#                grafana_dashboard: "1"
+#              searchNamespace: ALL means these can live in any namespace.
+#
+# NOTE: Community dashboards (gnetId) live in values.yaml under
+#       grafana.dashboards. This file is for custom/homegrown dashboards only.
+#
+# USAGE: Add a new dashboard by creating a new ConfigMap entry below.
+#        The data key must end in .json — Grafana uses the filename as the
+#        dashboard title source. Keep one dashboard per ConfigMap for clarity.
+# ------------------------------------------------------------------------------
+
+# Example structure — replace with real dashboard JSON when ready:
+#
+# apiVersion: v1
+# kind: ConfigMap
+# metadata:
+#   name: dashboard-mk-labs-overview
+#   namespace: monitoring
+#   labels:
+#     grafana_dashboard: "1"
+# data:
+#   mk-labs-overview.json: |
+#     {
+#       "title": "mk-labs Overview",
+#       "panels": [],
+#       ...
+#     }
diff --git a/cluster/applications/monitoring/values.yaml b/cluster/applications/monitoring/values.yaml
index 5bafa4d..52a48e7 100644
--- a/cluster/applications/monitoring/values.yaml
+++ b/cluster/applications/monitoring/values.yaml
@@ -247,26 +247,54 @@ grafana:
 
   dashboards:
     default:
+      # ── Already present ──────────────────────────────────────────────────────
       node-exporter-full:
         gnetId: 1860
         revision: 37
         datasource: Prometheus
-      kubernetes-cluster:
-        gnetId: 7249
-        revision: 1
-        datasource: Prometheus
-      kubernetes-pods:
-        gnetId: 6336
-        revision: 1
-        datasource: Prometheus
-      unifi-poller:
-        gnetId: 11315
-        revision: 9
-        datasource: Prometheus
       proxmox-cluster:
         gnetId: 10347
         revision: 5
         datasource: Prometheus
+      unifi-poller:
+        gnetId: 11315
+        revision: 9
+        datasource: Prometheus
+
+      # ── Kubernetes ───────────────────────────────────────────────────────────
+      kubernetes-global:
+        gnetId: 15757
+        revision: 37
+        datasource: Prometheus
+      kubernetes-namespace:
+        gnetId: 15758
+        revision: 34
+        datasource: Prometheus
+      kubernetes-pods:
+        gnetId: 6336
+        revision: 1
+        datasource: Prometheus
+
+      # ── Platform services ─────────────────────────────────────────────────────
+      argocd:
+        gnetId: 19974
+        revision: 3
+        datasource: Prometheus
+      cert-manager:
+        gnetId: 20842
+        revision: 3
+        datasource: Prometheus
+      cilium-dashboard:
+        gnetId: 16611
+        revision: 1
+        datasource: Prometheus
+
+      # ── Infrastructure ────────────────────────────────────────────────────────
+      # Traefik — uncomment when P.02 is done (--metrics.prometheus=true)
+      # traefik:
+      #   gnetId: 17346
+      #   revision: 9
+      #   datasource: Prometheus
 
   sidecar:
     dashboards: