diff --git a/common/telemetry.py b/common/telemetry.py
index 6353deb..fab1674 100644
--- a/common/telemetry.py
+++ b/common/telemetry.py
@@ -1,10 +1,15 @@
-from opentelemetry import trace
+import os
+
+from opentelemetry import metrics, trace
+from opentelemetry.sdk.metrics import MeterProvider
 from opentelemetry.sdk.resources import SERVICE_NAME, Resource
 from opentelemetry.sdk.trace import TracerProvider
 from opentelemetry.sdk.trace.export import BatchSpanProcessor
 from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter
+from opentelemetry.exporter.prometheus import PrometheusMetricReader
 from opentelemetry.instrumentation.httpx import HTTPXClientInstrumentor
 from opentelemetry.instrumentation.redis import RedisInstrumentor
+from prometheus_client import start_http_server
 
 
 def setup_telemetry(service_name: str):
@@ -14,6 +19,18 @@ def setup_telemetry(service_name: str):
     provider.add_span_processor(processor)
     trace.set_tracer_provider(provider)
 
+    # Pull, not push: Alloy 404s OTLP metrics, so Prometheus scrapes each
+    # service instead. The reader renders current values on every scrape.
+    # It serves on its own port rather than a FastAPI route so /metrics is
+    # never reachable through gateway's public Traefik router, and so the
+    # audit worker (no HTTP app) exposes metrics the same way.
+    reader = PrometheusMetricReader()
+    metrics.set_meter_provider(MeterProvider(resource=resource, metric_readers=[reader]))
+    start_http_server(
+        port=int(os.environ.get("OTEL_EXPORTER_PROMETHEUS_PORT", "9464")),
+        addr=os.environ.get("OTEL_EXPORTER_PROMETHEUS_HOST", "0.0.0.0"),
+    )
+
     # Process-wide patches on the client classes, so they also cover clients
     # created at import time (gateway's _proxy_client, common.redis_client).
     HTTPXClientInstrumentor().instrument()
diff --git a/requirements.txt b/requirements.txt
index 55bdaff..f1d7e54 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -11,3 +11,5 @@ python-multipart==0.0.20
 structlog==25.5.0
 opentelemetry-distro==0.66b1
 opentelemetry-exporter-otlp==1.45.1
+opentelemetry-exporter-prometheus==0.66b1
+prometheus-client==0.26.0