diff --git a/k8s/argocd/apps/10-storage-observability.yaml b/k8s/argocd/apps/10-storage-observability.yaml
index e706d76..ef9a212 100644
--- a/k8s/argocd/apps/10-storage-observability.yaml
+++ b/k8s/argocd/apps/10-storage-observability.yaml
@@ -100,6 +100,11 @@ spec:
     server: https://kubernetes.default.svc
     namespace: monitoring
   syncPolicy:
+    managedNamespaceMetadata:
+      # node-exporter needs hostNetwork/hostPID/hostPath/hostPort; blocked by
+      # default baseline PSS (DaemonSet created 0 pods, Prometheus STS stuck).
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true