diff --git a/docs/swarm/services.md b/docs/swarm/services.md
index 7a0e1da5..2e52ccb5 100644
--- a/docs/swarm/services.md
+++ b/docs/swarm/services.md
@@ -148,7 +148,7 @@ See `retentionPeriod` below before leaving it at its default.
 | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `deploy.victoriametrics.retentionPeriod` | Default `5y`. Lower it once you have measured how fast this swarm actually fills a disk — the default is deliberately generous because too-short silently discards history you can't get back. |
 | `swarm.grafana.oidc.role`                | Default `Admin` for everyone who logs in. Lower to `Viewer`/`Editor` if the swarm grows operators who shouldn't be able to reconfigure Grafana.                                                |
-| `deploy.grafana.datasourceUrl`           | Only if you front VictoriaMetrics with something else. It defaults to the store on this host, which is the only thing it can reach.                                                            |
+| `deploy.grafana.datasourceUrl`           | Only if you front VictoriaMetrics with something else. It defaults to the store's swarm name (`https://<swarm.victoriametrics.domain>`), so Grafana and the store can run on different hosts.  |
 
 <!-- vale write-good.Passive = NO -->
 
diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix
index 2286f9a2..db32cdfd 100644
--- a/nix/host-modules/swarm-grafana.nix
+++ b/nix/host-modules/swarm-grafana.nix
@@ -1,5 +1,5 @@
 # The swarm's metrics UI: one Grafana for the whole swarm, in a
-# `swarm-grafana` nixos-container next to the VictoriaMetrics store it reads.
+# `swarm-grafana` nixos-container, reading the VictoriaMetrics store.
 #
 # Two containers rather than one, on the operator's call: Grafana can be
 # restarted, reconfigured or broken without taking the TSDB down with it.
@@ -287,9 +287,7 @@ in
   # store path, and the directory it shares a socket with nginx through.
   # `enable` already lives in ./deploy.nix, which also carries the renames.
   #
-  # ⚠️ Both datasource URLs are wiring, so they live here. A URL's scope is the
-  # scope of what it ADDRESSES, not the fact that it is a URL: both stores
-  # bind loopback, so these can only ever mean "on this host".
+  # Both datasource URLs are wiring, so they live here.
   options.services.hyperhive.deploy.grafana = {
     package = lib.mkOption {
       type = lib.types.package;
@@ -324,14 +322,14 @@ in
 
     datasourceUrl = lib.mkOption {
       type = lib.types.str;
-      default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victoriametrics.port}";
-      defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victoriametrics.port}"'';
+      default = "https://${hyperhiveCfg.swarm.victoriametrics.domain}";
+      defaultText = lib.literalExpression ''"https://''${services.hyperhive.swarm.victoriametrics.domain}"'';
       description = ''
         Where the provisioned datasource points. Defaults to the metrics
-        store on this host, which is the only place it can be: that store
-        binds loopback, so a Grafana somewhere else could not reach it
-        anyway. Set explicitly if a deployment fronts VictoriaMetrics with
-        something that does listen wider.
+        store's swarm name, served by the gateway of whichever host runs the
+        store, so Grafana and the store need not share a host. The store's
+        query routes on that vhost take no credential, so the datasource
+        sends none.
       '';
     };
 
@@ -340,9 +338,9 @@ in
       default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victorialogs.port}";
       defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victorialogs.port}"'';
       description = ''
-        Where the provisioned logs datasource points. Same reasoning as
-        {option}`services.hyperhive.deploy.grafana.datasourceUrl`: the store
-        binds loopback, so a Grafana elsewhere could not reach it anyway.
+        Where the provisioned logs datasource points. Defaults to the log
+        store on this host, which binds loopback, so this default reaches
+        it only where Grafana and the store share a host.
 
         Provisioned unconditionally, like the metrics datasource — the store
         being off is a deployment choice rather than a reason to withhold the