diff --git a/platform/kubevirt/servicemonitor.yaml b/platform/kubevirt/servicemonitor.yaml
index e9e27ef..a85b774 100644
--- a/platform/kubevirt/servicemonitor.yaml
+++ b/platform/kubevirt/servicemonitor.yaml
@@ -8,8 +8,14 @@
 # Prometheus discovers ServiceMonitors cluster-wide (serviceMonitorSelectorNilUsesHelmValues:false in
 # platform/monitoring/kube-prometheus-stack.yaml), so these can live beside their target Services.
 # NOTE (verify at bring-up, same convention as alerts.yaml): KubeVirt serves metrics over HTTPS with a
-# self-signed internal cert (insecureSkipVerify) on the port named `metrics`; CDI serves plain HTTP on
-# its `metrics` port. Port names/scheme are confirmed against the deployed Services on first reconcile.
+# self-signed internal cert (insecureSkipVerify) on the port named `metrics`. virt-operator does NOT
+# ship its own ServiceMonitor, so this one is required.
+#
+# CDI is intentionally NOT scraped here: the cdi-operator manages its own `service-monitor-cdi`
+# (scheme https + a cdi-metrics-reader-token, owned by the cdi-operator Deployment) which backs CDI's
+# shipped recording rules (kubevirt_cdi_operator_up / cluster:kubevirt_cdi_operator_up:sum) and the
+# CDIOperatorDown alert. A second http ServiceMonitor here added down (400) targets for the same pods,
+# poisoning that up-aggregation to 0 and firing a false CDIOperatorDown — so it was removed.
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -31,23 +37,3 @@ spec:
         insecureSkipVerify: true
       honorLabels: true
       interval: 30s
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: cdi
-  namespace: cdi
-  labels:
-    release: kube-prometheus-stack
-spec:
-  selector:
-    matchLabels:
-      prometheus.cdi.kubevirt.io: "true"
-  namespaceSelector:
-    matchNames:
-      - cdi
-  endpoints:
-    - port: metrics
-      scheme: http
-      honorLabels: true
-      interval: 30s