diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix
index 522e4629..1a030fac 100644
--- a/nix/module-eval/core-toggle.nix
+++ b/nix/module-eval/core-toggle.nix
@@ -26,6 +26,7 @@ let
     bridgePorts
     bridgePortsOrNone
     swarmServiceEnables
+    otelSettings
     ;
 
   inherit (shared) allLocal;
@@ -399,6 +400,21 @@ let
         && lib.hasInfix "auth_request" m.extraConfig
         && lib.hasInfix "auth_request" l.extraConfig;
     }
+    {
+      # The metrics vhost is default-deny; the collector's push only lands
+      # because its `metrics_endpoint` path is the vhost's one gated exact
+      # location. The two literals live in different modules, so renaming
+      # either alone breaks ingest while everything still evaluates.
+      name = "the collector's metrics push path is a gated location on the metrics vhost";
+      ok =
+        let
+          endpoint = (otelSettings allLocal).exporters."otlphttp/victoriametrics".metrics_endpoint;
+          # "https://host/path" -> "/path"
+          path = "/" + lib.concatStringsSep "/" (lib.drop 3 (lib.splitString "/" endpoint));
+          loc = allLocal.services.nginx.virtualHosts."metrics.t.local".locations."= ${path}" or null;
+        in
+        loc != null && lib.hasInfix "auth_request" loc.extraConfig;
+    }
     {
       # The arm that actually protects something. A pusher handed
       # `error_page 401 =302` FOLLOWS it and POSTs its batch at a login page,