diff --git a/.env.example b/.env.example
index c3f62d94..8104063e 100644
--- a/.env.example
+++ b/.env.example
@@ -279,3 +279,10 @@ DB_PASSWORD=pedscribe_secret_change_me
 # OPENBAO_ROLE_ID=
 # OPENBAO_SECRET_ID=
 # OPENBAO_KV_PATH=kv/ped-ai/prod
+
+# Optional. Lets something outside this host scrape /metrics with
+# `Authorization: Bearer <token>`. Unset by default, and an unset token can
+# never match — Prometheus scrapes pediatric-ai-scribe:3000 directly over the
+# Docker network, which needs no token. Requests arriving through the reverse
+# proxy (they carry X-Forwarded-For) get a 404 either way.
+METRICS_TOKEN=
diff --git a/public/components/assistant.html b/public/components/assistant.html
index 28c9a91c..2a54a469 100644
--- a/public/components/assistant.html
+++ b/public/components/assistant.html
@@ -54,7 +54,11 @@
             <!-- Workspace launcher, rendered from the app's real .tab-btn list so
                  it cannot drift from the menu it mirrors. Desktop only: on a phone
                  the drawer already is the menu. -->
-            <div id="assistant-workspace-view" class="assistant-workspace-view" hidden>
+            <!-- No hidden attribute: this view is revealed by CSS on
+                 body.assistant-mode-workspace, and [hidden]{display:none!important}
+                 outranks that. .assistant-workspace-view is display:none by
+                 default, so it starts hidden either way. -->
+            <div id="assistant-workspace-view" class="assistant-workspace-view">
               <div id="assistant-workspace-cards" class="assistant-workspace-cards"></div>
             </div>
             <div id="assistant-chat-view">
diff --git a/server.js b/server.js
index 407db0e4..4d88ed2d 100644
--- a/server.js
+++ b/server.js
@@ -186,7 +186,22 @@ app.get('/api/build', function(req, res) { res.json({ buildId: BUILD_ID }); });
 // only after the first answer, so a fresh Grafana panel reads "no data"
 // instead of zero — which looks like broken wiring rather than a quiet day.
 require('./src/utils/citationAudit');
-app.get('/metrics', metricsHandler);
+// Metrics are for Prometheus, which scrapes pediatric-ai-scribe:3000 directly
+// over the Docker network. Served unguarded, this endpoint answered on every
+// public hostname: 201 lines naming routes, traffic volumes, event-loop timings
+// and process internals to anyone who asked. Nothing here is a credential, but
+// it is a free map of the application for someone probing it.
+//
+// A request that arrived through the reverse proxy carries X-Forwarded-For;
+// one from a container on our own network does not. That is the distinction
+// that matters here, and it does not depend on getting a CIDR list right.
+// METRICS_TOKEN allows an explicit override for scraping from elsewhere.
+app.get('/metrics', function (req, res, next) {
+  var token = process.env.METRICS_TOKEN;
+  if (token && req.get('authorization') === 'Bearer ' + token) return next();
+  if (req.get('x-forwarded-for')) return res.status(404).end();
+  return next();
+}, metricsHandler);
 
 app.use(loggingMiddleware);
 app.use('/vendor/dompurify', express.static(path.join(__dirname, 'node_modules', 'dompurify', 'dist'), {
diff --git a/test/policy-flows.test.js b/test/policy-flows.test.js
index 2422187e..46010975 100644
--- a/test/policy-flows.test.js
+++ b/test/policy-flows.test.js
@@ -576,3 +576,20 @@ test('a router mounted on /api must not gate the whole namespace', () => {
   }
 });
 
+
+test('metrics are not served to the internet', () => {
+  // Prometheus scrapes pediatric-ai-scribe:3000 directly over the Docker
+  // network. Served unguarded this answered on every public hostname with 201
+  // lines naming routes, traffic volumes and process internals — a free map of
+  // the application for anyone probing it. A request through the reverse proxy
+  // carries X-Forwarded-For; one from our own network does not.
+  const server = readSource('server.js');
+  const handler = server.slice(server.indexOf("app.get('/metrics'"), server.indexOf('metricsHandler);') + 16);
+  assert.match(handler, /if \(req\.get\('x-forwarded-for'\)\) return res\.status\(404\)\.end\(\);/,
+    'a proxied request gets nothing');
+  assert.match(handler, /process\.env\.METRICS_TOKEN/, 'with an explicit override for scraping from elsewhere');
+  assert.match(handler, /req\.get\('authorization'\) === 'Bearer ' \+ token/);
+  // The override must not be a way in when it is unset.
+  assert.match(handler, /var token = process\.env\.METRICS_TOKEN;\s*\n\s*if \(token &&/,
+    'an unset token can never match');
+});