diff --git a/i18n/translation-templates/docs/ansible.pot b/i18n/translation-templates/docs/ansible.pot
index a2441c103..02c17fbe3 100644
--- a/i18n/translation-templates/docs/ansible.pot
+++ b/i18n/translation-templates/docs/ansible.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-07-12 15:37+0000\n"
+"POT-Creation-Date: 2026-07-28 05:05+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -77,120 +77,144 @@ msgid "**Note**: Both of the above methods are a bad way to run system software
 msgstr ""
 
 #: ../../../docs/ansible.md:42
-msgid "Using Ansible via Docker"
+msgid "SSH host key and passphrase prompts"
 msgstr ""
 
 #: ../../../docs/ansible.md:44
-msgid "Alternatively, you can run Ansible inside a Docker container (powered by the [ghcr.io/devture/ansible](https://github.com/devture/docker-ansible/pkgs/container/ansible) Docker image)."
+msgid "If Ansible fails with `Host key verification failed` (or a similar `Data could not be sent to remote host` error) without asking you to confirm the SSH host key of your server, you're likely on Ansible 2.21 or later."
 msgstr ""
 
 #: ../../../docs/ansible.md:46
-msgid "This ensures that:"
+msgid "Since Ansible 2.21, forked workers call `setsid()` and thus lose the controlling terminal. SSH cannot open `/dev/tty` anymore, so it can no longer ask you to confirm an unknown host key or prompt you for the passphrase of an SSH key."
 msgstr ""
 
 #: ../../../docs/ansible.md:48
-msgid "you're using a very recent Ansible version, which is less likely to be incompatible with the playbook"
+msgid "The simplest fix is to connect to the server once (e.g. `ssh root@matrix.example.com`) and confirm the host key. Ansible runs after that will find it in your `known_hosts` file."
 msgstr ""
 
-#: ../../../docs/ansible.md:49
-msgid "you also get access to the [agru](https://github.com/etkecc/agru) tool for quicker Ansible role installation (when running `just roles`) compared to `ansible-galaxy`"
+#: ../../../docs/ansible.md:50
+msgid "Alternatively, run Ansible with the `ANSIBLE_WORKER_SESSION_ISOLATION=False` environment variable to get these prompts back (e.g. `ANSIBLE_WORKER_SESSION_ISOLATION=False just install-all`)."
 msgstr ""
 
-#: ../../../docs/ansible.md:51
-msgid "You can either [run Ansible in a container on the Matrix server itself](#running-ansible-in-a-container-on-the-matrix-server-itself) or [run Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server)."
+#: ../../../docs/ansible.md:52
+msgid "**Note**: this does not affect you if you're [using Ansible via Docker](#using-ansible-via-docker), because our Docker image already disables session isolation for you."
 msgstr ""
 
-#: ../../../docs/ansible.md:53
-msgid "💡 If you use [Visual Studio Code](https://code.visualstudio.com/) or [GitHub Codespaces](https://github.com/features/codespaces), the playbook also ships a [dev container](https://containers.dev/) configuration (see the `.devcontainer/` directory) based on this same Ansible Docker image, which can prepare such a containerized Ansible environment for you automatically."
+#: ../../../docs/ansible.md:54
+msgid "Using Ansible via Docker"
 msgstr ""
 
-#: ../../../docs/ansible.md:55
-msgid "Running Ansible in a container on the Matrix server itself"
+#: ../../../docs/ansible.md:56
+msgid "Alternatively, you can run Ansible inside a Docker container (powered by the [ghcr.io/devture/ansible](https://github.com/devture/docker-ansible/pkgs/container/ansible) Docker image)."
 msgstr ""
 
-#: ../../../docs/ansible.md:57
-msgid "To run Ansible in a (Docker) container on the Matrix server itself, you need to have a working Docker installation. Docker is normally installed by the playbook, so this may be a bit of a chicken and egg problem. To solve it:"
-msgstr ""
-
-#: ../../../docs/ansible.md:59
-msgid "you **either** need to install Docker manually first. Follow [the upstream instructions](https://docs.docker.com/engine/install/) for your distribution and consider setting `matrix_playbook_docker_installation_enabled: false` in your `vars.yml` file, to prevent the playbook from installing Docker"
+#: ../../../docs/ansible.md:58
+msgid "This ensures that:"
 msgstr ""
 
 #: ../../../docs/ansible.md:60
+msgid "you're using a very recent Ansible version, which is less likely to be incompatible with the playbook"
+msgstr ""
+
+#: ../../../docs/ansible.md:61
+msgid "you also get access to the [agru](https://github.com/etkecc/agru) tool for quicker Ansible role installation (when running `just roles`) compared to `ansible-galaxy`"
+msgstr ""
+
+#: ../../../docs/ansible.md:63
+msgid "You can either [run Ansible in a container on the Matrix server itself](#running-ansible-in-a-container-on-the-matrix-server-itself) or [run Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server)."
+msgstr ""
+
+#: ../../../docs/ansible.md:65
+msgid "💡 If you use [Visual Studio Code](https://code.visualstudio.com/) or [GitHub Codespaces](https://github.com/features/codespaces), the playbook also ships a [dev container](https://containers.dev/) configuration (see the `.devcontainer/` directory) based on this same Ansible Docker image, which can prepare such a containerized Ansible environment for you automatically."
+msgstr ""
+
+#: ../../../docs/ansible.md:67
+msgid "Running Ansible in a container on the Matrix server itself"
+msgstr ""
+
+#: ../../../docs/ansible.md:69
+msgid "To run Ansible in a (Docker) container on the Matrix server itself, you need to have a working Docker installation. Docker is normally installed by the playbook, so this may be a bit of a chicken and egg problem. To solve it:"
+msgstr ""
+
+#: ../../../docs/ansible.md:71
+msgid "you **either** need to install Docker manually first. Follow [the upstream instructions](https://docs.docker.com/engine/install/) for your distribution and consider setting `matrix_playbook_docker_installation_enabled: false` in your `vars.yml` file, to prevent the playbook from installing Docker"
+msgstr ""
+
+#: ../../../docs/ansible.md:72
 msgid "**or** you need to run the playbook in another way (e.g. [Running Ansible in a container on another computer (not the Matrix server)](#running-ansible-in-a-container-on-another-computer-not-the-matrix-server)) at least the first time around"
 msgstr ""
 
-#: ../../../docs/ansible.md:62
+#: ../../../docs/ansible.md:74
 msgid "Once you have a working Docker installation on the server, **clone the playbook** somewhere on the server and configure it as per usual (`inventory/hosts`, `inventory/host_vars/…`, etc.), as described in [configuring the playbook](configuring-playbook.md)."
 msgstr ""
 
-#: ../../../docs/ansible.md:64
+#: ../../../docs/ansible.md:76
 msgid "You would then need to add `ansible_connection=community.docker.nsenter` to the host line in `inventory/hosts`. This tells Ansible to connect to the \"remote\" machine by switching Linux namespaces with [nsenter](https://man7.org/linux/man-pages/man1/nsenter.1.html), instead of using SSH."
 msgstr ""
 
-#: ../../../docs/ansible.md:66
+#: ../../../docs/ansible.md:78
 msgid "Alternatively, you can leave your `inventory/hosts` as is and specify the connection type in **each** `ansible-playbook` call you do later, like this: `just install-all --connection=community.docker.nsenter` (or `ansible-playbook --connection=community.docker.nsenter …`)."
 msgstr ""
 
-#: ../../../docs/ansible.md:68
-#: ../../../docs/ansible.md:90
+#: ../../../docs/ansible.md:80
+#: ../../../docs/ansible.md:102
 msgid "Run this from the playbook's directory:"
 msgstr ""
 
-#: ../../../docs/ansible.md:82
-#: ../../../docs/ansible.md:105
+#: ../../../docs/ansible.md:94
+#: ../../../docs/ansible.md:117
 msgid "Once you execute the above command, you'll be dropped into a `/work` directory inside a Docker container. The `/work` directory contains the playbook's code."
 msgstr ""
 
-#: ../../../docs/ansible.md:84
-#: ../../../docs/ansible.md:107
+#: ../../../docs/ansible.md:96
+#: ../../../docs/ansible.md:119
 msgid "First, consider running `git config --global --add safe.directory /work` to [resolve directory ownership issues](#resolve-directory-ownership-issues)."
 msgstr ""
 
-#: ../../../docs/ansible.md:86
+#: ../../../docs/ansible.md:98
 msgid "Finally, you can execute `just` or `ansible-playbook …` (e.g. `ansible-playbook --connection=community.docker.nsenter …`) commands as per normal now."
 msgstr ""
 
-#: ../../../docs/ansible.md:88
+#: ../../../docs/ansible.md:100
 msgid "Running Ansible in a container on another computer (not the Matrix server)"
 msgstr ""
 
-#: ../../../docs/ansible.md:103
+#: ../../../docs/ansible.md:115
 msgid "The above command tries to mount an SSH key (`$HOME/.ssh/id_ed25519`) into the container (at `/root/.ssh/id_ed25519`). If your SSH key is at a different path (not in `$HOME/.ssh/id_ed25519`), adjust that part."
 msgstr ""
 
-#: ../../../docs/ansible.md:109
+#: ../../../docs/ansible.md:121
 msgid "Finally, you execute `just` or `ansible-playbook …` commands as per normal now."
 msgstr ""
 
-#: ../../../docs/ansible.md:111
+#: ../../../docs/ansible.md:123
 msgid "If you don't use SSH keys for authentication"
 msgstr ""
 
-#: ../../../docs/ansible.md:113
+#: ../../../docs/ansible.md:125
 msgid "If you don't use SSH keys for authentication, simply remove that whole line (`--mount type=bind,src$HOME/.ssh/id_ed25519,dst=/root/.ssh/id_ed25519,ro`)."
 msgstr ""
 
-#: ../../../docs/ansible.md:115
+#: ../../../docs/ansible.md:127
 msgid "To authenticate at your server using a password, you need to add a package. So, when you are in the shell of the ansible docker container (the previously used `docker run -it …` command), run:"
 msgstr ""
 
-#: ../../../docs/ansible.md:121
+#: ../../../docs/ansible.md:133
 msgid "Then, to be asked for the password whenever running an `ansible-playbook` command add `--ask-pass` to the arguments of the command."
 msgstr ""
 
-#: ../../../docs/ansible.md:123
+#: ../../../docs/ansible.md:135
 msgid "Resolve directory ownership issues"
 msgstr ""
 
-#: ../../../docs/ansible.md:125
+#: ../../../docs/ansible.md:137
 msgid "Because you're `root` in the container running Ansible and this likely differs from the owner (your regular user account) of the playbook directory outside of the container, certain playbook features which use `git` locally may report warnings such as:"
 msgstr ""
 
-#: ../../../docs/ansible.md:127
+#: ../../../docs/ansible.md:139
 msgid "fatal: unsafe repository ('/work' is owned by someone else) To add an exception for this directory, call:  git config --global --add safe.directory /work"
 msgstr ""
 
-#: ../../../docs/ansible.md:131
+#: ../../../docs/ansible.md:143
 msgid "These errors can be resolved by making `git` trust the playbook directory by running `git config --global --add safe.directory /work`"
 msgstr ""
diff --git a/i18n/translation-templates/docs/configuring-playbook-prometheus-grafana.pot b/i18n/translation-templates/docs/configuring-playbook-prometheus-grafana.pot
index bb4f67b02..02b454853 100644
--- a/i18n/translation-templates/docs/configuring-playbook-prometheus-grafana.pot
+++ b/i18n/translation-templates/docs/configuring-playbook-prometheus-grafana.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: matrix-docker-ansible-deploy \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-19 07:40+0000\n"
+"POT-Creation-Date: 2026-07-28 05:05+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -330,90 +330,106 @@ msgstr ""
 msgid "Set this to `true` to expose the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) metrics on `https://matrix.example.com/metrics/nginxlog`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:187
-msgid "Expose metrics of other services/roles"
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:0
+msgid "`ntfy_metrics_listen_http_port`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:0
+msgid "Set this to a port number (e.g. `9090`) to make [ntfy](configuring-playbook-ntfy.md) serve its metrics (locally, on the container network) on that port."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:0
+msgid "`ntfy_container_labels_traefik_metrics_enabled`"
+msgstr ""
+
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:0
+msgid "Set this to `true` to expose the [ntfy](configuring-playbook-ntfy.md) metrics on `https://matrix.example.com/metrics/ntfy`."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-prometheus-grafana.md:189
-msgid "Various other services/roles may provide similar `_metrics_enabled` and `_metrics_proxying_enabled` variables for exposing their metrics. Refer to each role for details."
+msgid "Expose metrics of other services/roles"
 msgstr ""
 
 #: ../../../docs/configuring-playbook-prometheus-grafana.md:191
-msgid "To password-protect the metrics of a specific role, you can use `matrix_SERVICE_container_labels_metrics_middleware_basic_auth_enabled` and `matrix_SERVICE_container_labels_metrics_middleware_basic_auth_users` variables provided by the role."
+msgid "Various other services/roles may provide similar `_metrics_enabled` and `_metrics_proxying_enabled` variables for exposing their metrics. Refer to each role for details."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-prometheus-grafana.md:193
-msgid "**Note**: alternatively you can use `matrix_metrics_exposure_http_basic_auth_enabled` and `matrix_metrics_exposure_http_basic_auth_users` in order to password-protect the metrics of all services."
+msgid "To password-protect the metrics of a specific role, you can use `matrix_SERVICE_container_labels_metrics_middleware_basic_auth_enabled` and `matrix_SERVICE_container_labels_metrics_middleware_basic_auth_users` variables provided by the role."
 msgstr ""
 
 #: ../../../docs/configuring-playbook-prometheus-grafana.md:195
+msgid "**Note**: alternatively you can use `matrix_metrics_exposure_http_basic_auth_enabled` and `matrix_metrics_exposure_http_basic_auth_users` in order to password-protect the metrics of all services."
+msgstr ""
+
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:197
 msgid "For example, you can enable and expose metrics for Synapse protecting them with dedicated credentials by adding the following configuration to your `vars.yml` file:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:213
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:215
 msgid "Collecting Synapse worker metrics to an external Prometheus server"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:215
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:217
 msgid "If you are using workers (`matrix_synapse_workers_enabled: true`) and have enabled `matrix_synapse_metrics_proxying_enabled` as described above, the playbook will also automatically expose all Synapse worker threads' metrics to `https://matrix.example.com/metrics/synapse/worker/ID`, where `ID` corresponds to the worker `id` as exemplified in `matrix_synapse_workers_enabled_list`."
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:217
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:219
 msgid "The playbook also generates an exemplary config file (`/matrix/synapse/external_prometheus.yml.template`) with all the correct paths which you can copy to your Prometheus server and adapt to your needs. Make sure to edit the specified `password_file` path and contents and path to your `synapse-v2.rules`. It will look a bit like this:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:245
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:247
 msgid "Troubleshooting"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:247
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:249
 msgid "As with all other services, you can find the logs in [systemd-journald](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html) by logging in to the server with SSH and running the commands below:"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:248
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:250
 msgid "`journalctl -fu matrix-prometheus` for Prometheus"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:249
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:251
 msgid "`journalctl -fu matrix-prometheus-node-exporter` for Node Exporter"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:250
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:252
 msgid "`journalctl -fu matrix-prometheus-postgres-exporter` for PostgreSQL Server Exporter"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:251
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:253
 msgid "`journalctl -fu matrix-prometheus-nginxlog-exporter` for prometheus-nginxlog-exporter"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:252
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:254
 msgid "`journalctl -fu matrix-grafana` for Grafana"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:254
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:256
 msgid "More information"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:256
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:258
 msgid "[Enabling synapse-usage-exporter for Synapse usage statistics](configuring-playbook-synapse-usage-exporter.md)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:257
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:259
 msgid "[Understanding Synapse Performance Issues Through Grafana Graphs](https://element-hq.github.io/synapse/latest/usage/administration/understanding_synapse_through_grafana_graphs.html) at the Synapse Github Wiki"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:258
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:260
 msgid "[The Prometheus scraping rules](https://github.com/element-hq/synapse/tree/master/contrib/prometheus) (we use v2)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:259
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:261
 msgid "[The Synapse Grafana dashboard](https://github.com/element-hq/synapse/tree/master/contrib/grafana)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:260
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:262
 msgid "[The Node Exporter dashboard](https://github.com/rfrail3/grafana-dashboards) (for generic non-synapse performance graphs)"
 msgstr ""
 
-#: ../../../docs/configuring-playbook-prometheus-grafana.md:261
+#: ../../../docs/configuring-playbook-prometheus-grafana.md:263
 msgid "[The PostgreSQL dashboard](https://grafana.com/grafana/dashboards/9628) (generic Postgres dashboard)"
 msgstr ""