diff --git a/monitoring.yml b/monitoring.yml
index b1800360..28bdb056 100644
--- a/monitoring.yml
+++ b/monitoring.yml
@@ -169,7 +169,12 @@ services:
 
   telegraf:
     image: telegraf:latest
-    user: "0:994"
+    # Run as root and bypass the image's gosu privilege-drop so telegraf reads the
+    # docker socket as its OWNER (root). Avoids hardcoding the host docker group GID,
+    # which is auto-assigned and varies per host (e.g. 994 vs 988) - a hardcoded gid
+    # silently breaks telegraf's docker input wherever the gid differs.
+    user: "0:0"
+    entrypoint: ["telegraf"]
     container_name: telegraf
     restart: unless-stopped
     networks: