diff --git a/ansible/roles/monitoring_agent/templates/config.alloy.j2 b/ansible/roles/monitoring_agent/templates/config.alloy.j2
index 719f95b..8ed946b 100644
--- a/ansible/roles/monitoring_agent/templates/config.alloy.j2
+++ b/ansible/roles/monitoring_agent/templates/config.alloy.j2
@@ -46,6 +46,14 @@ loki.relabel "journal" {
     source_labels = ["__journal__systemd_unit"]
     target_label  = "unit"
   }
+  // Every SSH login (Ansible, CI deploys) gets its own session-N.scope:
+  // one stream each blew Loki's active stream limit.
+  rule {
+    source_labels = ["unit"]
+    regex         = "session-\\d+\\.scope"
+    target_label  = "unit"
+    replacement   = "session.scope"
+  }
   rule {
     source_labels = ["__journal_priority_keyword"]
     target_label  = "level"
diff --git a/ansible/roles/monitoring_agent/templates/docker-compose.yml.j2 b/ansible/roles/monitoring_agent/templates/docker-compose.yml.j2
index 60e43be..eb0524b 100644
--- a/ansible/roles/monitoring_agent/templates/docker-compose.yml.j2
+++ b/ansible/roles/monitoring_agent/templates/docker-compose.yml.j2
@@ -37,6 +37,12 @@ services:
       - /sys:/sys:ro
       - /var/lib/docker/:/var/lib/docker:ro
       - /dev/disk/:/dev/disk:ro
+    healthcheck:
+      # The image probes localhost:8080; we listen on the VPC address only.
+      test: ["CMD", "wget", "-q", "--tries=1", "--spider", "http://{{ vpc_ip }}:{{ monitoring_cadvisor_port }}/healthz"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
     restart: unless-stopped
     mem_limit: 192m