diff --git a/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-metrics-auth.yaml b/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-metrics-auth.yaml
new file mode 100644
index 000000000..3a2d8f495
--- /dev/null
+++ b/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-browser-metrics-auth.yaml
@@ -0,0 +1,51 @@
+---
+# Source: searxng/templates/external-secret.yaml
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: searxng-wireguard-conf
+  namespace: searxng
+  labels:
+    app.kubernetes.io/name: searxng-wireguard-conf
+    app.kubernetes.io/instance: searxng
+    app.kubernetes.io/part-of: searxng
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: private-key
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /protonvpn/conf/cl01tl
+        metadataPolicy: None
+        property: private-key
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: searxng-browser-metrics-auth
+  namespace: searxng
+  labels:
+    app.kubernetes.io/name: searxng-browser-metrics-auth
+    app.kubernetes.io/instance: searxng
+    app.kubernetes.io/part-of: searxng
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: metrics-password
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: cl01tl/searxng/browser
+        metadataPolicy: None
+        property: metrics-password
+    - secretKey: metrics-username
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: cl01tl/searxng/browser
+        metadataPolicy: None
+        property: metrics-username
diff --git a/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-wireguard-conf.yaml b/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-wireguard-conf.yaml
deleted file mode 100644
index f48682c53..000000000
--- a/clusters/cl01tl/manifests/searxng/ExternalSecret-searxng-wireguard-conf.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: searxng-wireguard-conf
-  namespace: searxng
-  labels:
-    app.kubernetes.io/name: searxng-wireguard-conf
-    app.kubernetes.io/instance: searxng
-    app.kubernetes.io/part-of: searxng
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: private-key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /protonvpn/conf/cl01tl
-        metadataPolicy: None
-        property: private-key
diff --git a/clusters/cl01tl/manifests/searxng/ServiceMonitor-searxng-browser.yaml b/clusters/cl01tl/manifests/searxng/ServiceMonitor-searxng-browser.yaml
new file mode 100644
index 000000000..e95bdad7b
--- /dev/null
+++ b/clusters/cl01tl/manifests/searxng/ServiceMonitor-searxng-browser.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: searxng-browser
+  namespace: searxng
+  labels:
+    app.kubernetes.io/name: searxng-browser
+    app.kubernetes.io/instance: searxng
+    app.kubernetes.io/part-of: searxng
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: searxng-browser
+      app.kubernetes.io/instance: searxng
+  endpoints:
+    - port: mail
+      interval: 30s
+      scrapeTimeout: 15s
+      path: /metrics
+      basicAuth:
+        password:
+          name: searxng-browser-metrics-auth
+          key: metrics-password
+        username:
+          name: searxng-browser-metrics-auth
+          key: metrics-username