diff --git a/ansible/roles/monitoring/defaults/main.yaml b/ansible/roles/monitoring/defaults/main.yaml
index 293e704..5cd27c7 100644
--- a/ansible/roles/monitoring/defaults/main.yaml
+++ b/ansible/roles/monitoring/defaults/main.yaml
@@ -16,7 +16,9 @@ monitoring_probes:
   - { name: forgejo, target: "https://git.asxp.io/", module: http_2xx }
   - { name: s3, target: "https://s3.asxp.io/", module: http_up }
   - { name: sillytavern, target: "http://{{ asxpio_services_wireguard_ip }}:8000/", module: http_up }
-  - { name: xmpp c2s starttls, target: "xmpp.asxp.io:5222", module: xmpp_starttls }
+  # blackbox matches responses line by line and ejabberd sends no newlines,
+  # so a STARTTLS dialogue times out: plain connect here, TLS on 5223.
+  - { name: xmpp c2s, target: "xmpp.asxp.io:5222", module: tcp_connect }
   - { name: xmpp c2s tls, target: "xmpp.asxp.io:5223", module: tls_connect }
   - { name: xmpp s2s, target: "xmpp.asxp.io:5269", module: tcp_connect }
   - { name: turn, target: "xmpp.asxp.io:3478", module: tcp_connect }
diff --git a/ansible/roles/monitoring/templates/blackbox.yml.j2 b/ansible/roles/monitoring/templates/blackbox.yml.j2
index 402c3eb..27c3bc3 100644
--- a/ansible/roles/monitoring/templates/blackbox.yml.j2
+++ b/ansible/roles/monitoring/templates/blackbox.yml.j2
@@ -25,14 +25,3 @@ modules:
     tcp:
       preferred_ip_protocol: ip4
   # XMPP client port: stream header, STARTTLS, then the certificate
-  xmpp_starttls:
-    prober: tcp
-    timeout: 10s
-    tcp:
-      preferred_ip_protocol: ip4
-      query_response:
-        - send: "<?xml version='1.0'?><stream:stream to='asxp.io' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'>"
-        - expect: "urn:ietf:params:xml:ns:xmpp-tls"
-        - send: "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>"
-        - expect: "<proceed"
-        - starttls: true