diff --git a/platform/monitoring/kube-prometheus-stack.yaml b/platform/monitoring/kube-prometheus-stack.yaml
index 9ae402c..ec660b5 100644
--- a/platform/monitoring/kube-prometheus-stack.yaml
+++ b/platform/monitoring/kube-prometheus-stack.yaml
@@ -126,6 +126,11 @@ spec:
     # --- Grafana: dashboards (R-OBS-03), surfaced in the C2 UI (docs/12) behind Keycloak SSO ---
     grafana:
       enabled: true
+      # Force a pod roll when the OIDC wiring changes so Grafana loads the grafana-oidc-credentials
+      # client-secret (env valueFrom is resolved at pod start; the secret was added after first boot, so
+      # generic_oauth started disabled). Bump this value to re-roll Grafana on future OIDC secret changes.
+      podAnnotations:
+        homelab.keithjackson.dev/oidc-rollout: "1"
       # Admin bootstrap + (later) OIDC client are SOPS secrets referenced BY NAME (WS-SEC/ADR-0014).
       admin:
         existingSecret: grafana-admin-credentials