diff --git a/docs/configuring-playbook-prometheus-grafana.md b/docs/configuring-playbook-prometheus-grafana.md
index 41f14cb98..3b022a987 100644
--- a/docs/configuring-playbook-prometheus-grafana.md
+++ b/docs/configuring-playbook-prometheus-grafana.md
@@ -183,6 +183,8 @@ Name | Description
 `prometheus_postgres_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [Postgres exporter](#enable-metrics-and-graphs-for-postgres-optional) metrics on `https://matrix.example.com/metrics/postgres-exporter`.
 `prometheus_nginxlog_exporter_enabled`|Set this to `true` to enable the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) (locally, on the container network).
 `prometheus_nginxlog_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) metrics on `https://matrix.example.com/metrics/nginxlog`.
+`ntfy_metrics_listen_http_port`|Set this to a port number (e.g. `9090`) to make [ntfy](configuring-playbook-ntfy.md) serve its metrics (locally, on the container network) on that port.
+`ntfy_container_labels_traefik_metrics_enabled`|Set this to `true` to expose the [ntfy](configuring-playbook-ntfy.md) metrics on `https://matrix.example.com/metrics/ntfy`.
 
 ### Expose metrics of other services/roles
 
diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers
index 1664047b6..a866f9e71 100755
--- a/group_vars/matrix_servers
+++ b/group_vars/matrix_servers
@@ -4408,6 +4408,21 @@ ntfy_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxya
 ntfy_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
 ntfy_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
 
+# We have ntfy serve its metrics endpoint on a dedicated port, instead of on the regular HTTP port.
+# Were it served on the regular HTTP port, the endpoint would also become reachable at `https://ntfy.example.com/metrics`.
+# Nothing protects it there, because ntfy does not apply its own access-control rules to the metrics endpoint.
+ntfy_metrics_listen_http_port: "{{ 9090 if matrix_metrics_exposure_enabled else '' }}"
+
+ntfy_container_labels_traefik_metrics_enabled: "{{ matrix_metrics_exposure_enabled }}"
+
+# For consistency with other things hosted at the Matrix FQN, we adjust the metrics endpoint
+# so that metrics would be served at something like `/metrics/SERVICE_NAME`, and not at the default path for the role (`/metrics`).
+ntfy_container_labels_traefik_metrics_hostname: "{{ matrix_server_fqn_matrix }}"
+ntfy_container_labels_traefik_metrics_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/ntfy"
+
+ntfy_container_labels_traefik_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+ntfy_container_labels_traefik_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+
 ntfy_visitor_request_limit_exempt_hosts_hostnames_auto: |
   {{
     [matrix_server_fqn_matrix]