diff --git a/monitoring/README.md b/monitoring/README.md
index 3cbdd72..f0be5a1 100644
--- a/monitoring/README.md
+++ b/monitoring/README.md
@@ -14,8 +14,7 @@
 | cast04 | 10.7.16.239 | Monitoring host | Prometheus + Grafana + Alertmanager + blackbox + node |
 | cast01 | 10.7.16.236 | App + Gitea + PostgreSQL | node + postgres_exporter |
 | cast02 | 10.7.16.237 | App | node_exporter |
-| cast03 | 10.7.16.238 | App | node_exporter |
-| artc0 | 10.7.16.128 | BE + MariaDB + Docker | node + mysqld_exporter (Docker) |
+| cast03 | 10.7.16.238 | App + MariaDB replica | node_exporter |
 
 ## Access
 
@@ -37,13 +36,12 @@
 | `/var/lib/grafana/provisioning/` | Auto-provisioned datasource + dashboards dir |
 | `/etc/conf.d/grafana` | Grafana runtime overrides (bind address, provisioning path) |
 
-## Config files (on artc0/BE)
+## Config files (on cast01–03 BE)
 
 | File | Purpose |
 |------|---------|
-| `/etc/nginx/conf.d/apps.conf` | BE nginx — includes monitoring proxy location |
-| `/var/www/.../api/grafana-auth-check.php` | PHP session → X-WEBAUTH-USER auth bridge |
-| `/etc/mysqld-exporter.cnf` | MariaDB exporter credentials |
+| `/etc/nginx/conf.d/androidcast.conf` | BE nginx — Grafana/Alertmanager proxy + auth_request |
+| `/var/www/ac/composed/backend/public/api/grafana-auth-check.php` | PHP session → X-WEBAUTH-USER auth bridge |
 
 ## Services management (cast04)
 
diff --git a/monitoring/cast04/alert-notifier.env b/monitoring/cast04/alert-notifier.env
index 5ae932e..def2dd7 100644
--- a/monitoring/cast04/alert-notifier.env
+++ b/monitoring/cast04/alert-notifier.env
@@ -2,7 +2,7 @@
 # Keep this file readable only by the service user (chmod 600).
 
 # ── URL shortener ──────────────────────────────────────────────────────────
-SHORTENER_INTERNAL=http://10.7.16.128
+SHORTENER_INTERNAL=http://10.7.16.236
 SHORTENER_HOST_HDR=s.f0xx.org
 SHORTENER_BEARER=3b7031ef38d9a5cb33f6b2e789c27fe8ae32c743f6aa8df7
 SHORTENER_TTL=86400
diff --git a/monitoring/cast04/alert-notifier.py b/monitoring/cast04/alert-notifier.py
index 438eb41..6056180 100644
--- a/monitoring/cast04/alert-notifier.py
+++ b/monitoring/cast04/alert-notifier.py
@@ -27,7 +27,7 @@ import sys
 import pathlib
 
 # ── Config defaults (overridden by .env file) ───────────────────────────────
-SHORTENER_INTERNAL = os.environ.get('SHORTENER_INTERNAL', 'http://10.7.16.128')
+SHORTENER_INTERNAL = os.environ.get('SHORTENER_INTERNAL', 'http://10.7.16.236')
 SHORTENER_HOST_HDR = os.environ.get('SHORTENER_HOST_HDR', 's.f0xx.org')
 SHORTENER_BEARER   = os.environ.get('SHORTENER_BEARER',   '')
 SHORTENER_TTL      = int(os.environ.get('SHORTENER_TTL',  '86400'))   # 1 day default
diff --git a/monitoring/cast04/grafana.ini b/monitoring/cast04/grafana.ini
index c506dc6..d5156fe 100644
--- a/monitoring/cast04/grafana.ini
+++ b/monitoring/cast04/grafana.ini
@@ -53,8 +53,8 @@ enabled = true
 header_name = X-WEBAUTH-USER
 header_property = username
 auto_sign_up = true
-# Only trust the header from artc0 nginx (10.7.16.128):
-whitelist = 10.7.16.128
+# Trust X-WEBAUTH-USER only from cluster BE nginx (cast01–03):
+whitelist = 10.7.16.236,10.7.16.237,10.7.16.238
 # Sync roles from header (optional, set X-WEBAUTH-ROLE in nginx if needed):
 # headers = Role:X-WEBAUTH-ROLE
 
diff --git a/monitoring/cast04/prometheus.yml b/monitoring/cast04/prometheus.yml
index e1715e0..1be3133 100644
--- a/monitoring/cast04/prometheus.yml
+++ b/monitoring/cast04/prometheus.yml
@@ -27,7 +27,6 @@ scrape_configs:
           - '10.7.16.237:9100'   # cast02
           - '10.7.16.238:9100'   # cast03
           - '10.7.16.239:9100'   # cast04 (self)
-          - '10.7.16.128:9100'   # artc0 (legacy, monitoring only)
         labels:
           env: 'production'
     relabel_configs:
@@ -47,10 +46,6 @@ scrape_configs:
         regex: '(10\.7\.16\.239):.*'
         target_label: instance
         replacement: 'cast04'
-      - source_labels: [__address__]
-        regex: '(10\.7\.16\.128):.*'
-        target_label: instance
-        replacement: 'artc0'
 
   # ── blackbox_exporter — internal HTTP probes (no TLS issues) ────────────────
   - job_name: 'blackbox_http'