diff --git a/nix/host-modules/swarm-otel.nix b/nix/host-modules/swarm-otel.nix
index 60a8faa3..4408ab49 100644
--- a/nix/host-modules/swarm-otel.nix
+++ b/nix/host-modules/swarm-otel.nix
@@ -865,6 +865,19 @@ in
                           # secret, or it lands in the store world-readable.
                           client_secret_file = collectorSecretPath;
                           token_url = "${autheliaCfg.url}/api/oidc/token";
+                          # The scope authelia's bearer-authz check looks for.
+                          # The client is REGISTERED for it (the collector's
+                          # entry sets `bearerAuthz`), but prometheus asks for
+                          # no scopes unless told to, so the token came back
+                          # carrying none and every scrape was refused at
+                          # introspection with "the requested scope is
+                          # invalid, unknown, or malformed".
+                          #
+                          # Which is the rule stated directly below for the
+                          # other field, and it was written here before this
+                          # line existed: the two travel together, and a
+                          # config read cannot see the one that is MISSING.
+                          scopes = [ "authelia.bearer.authz" ];
                           # The audience is the target's own url, and authelia
                           # checks it against the address being requested.
                           # Registered ≠ requested: a client that does not ASK