diff --git a/k8s/argocd/apps/10-storage-observability.yaml b/k8s/argocd/apps/10-storage-observability.yaml
index ef9a212..15c370f 100644
--- a/k8s/argocd/apps/10-storage-observability.yaml
+++ b/k8s/argocd/apps/10-storage-observability.yaml
@@ -110,7 +110,9 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-      - ServerSideApply=true
+      # ServerSideApply removed — it conflicts with managedNamespaceMetadata's
+      # forced namespace apply ("--force cannot be used with --server-side").
+      # The large monitoring CRDs are installed out-of-band instead.
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
diff --git a/k8s/platform/monitoring/prometheus-values.yaml b/k8s/platform/monitoring/prometheus-values.yaml
index 47a819d..d0828bb 100644
--- a/k8s/platform/monitoring/prometheus-values.yaml
+++ b/k8s/platform/monitoring/prometheus-values.yaml
@@ -36,12 +36,18 @@ prometheus:
     scrapeTimeout: 60s
     evaluationInterval: 30s
 
+    # Pin to az-a (talos-cp-1) — sole Longhorn node; else the RWO PVC can't
+    # attach on cp-2/cp-3 (CSINode lacks driver.longhorn.io).
+    nodeSelector:
+      topology.kubernetes.io/zone: az-a
+
     # Persistent storage — metrics survive node reboots and pod restarts.
-    # Longhorn reattaches the PVC automatically when the pod reschedules.
+    # longhorn-wffc (WaitForFirstConsumer) binds after scheduling so the volume
+    # lands on the node the pod runs on.
     storageSpec:
       volumeClaimTemplate:
         spec:
-          storageClassName: longhorn
+          storageClassName: longhorn-wffc
           accessModes: ["ReadWriteOnce"]
           resources:
             requests: