diff --git a/monitoring.yml b/monitoring.yml
index 8412cd10..abffbcc1 100644
--- a/monitoring.yml
+++ b/monitoring.yml
@@ -210,6 +210,10 @@ services:
   nodeexporter:
     image: prom/node-exporter
     container_name: nodeexporter
+    # Host network so the netdev collector (netlink) reads the HOST interfaces, not
+    # the container's idle veth — required for node_network_* (bandwidth) to be real.
+    # network_mode:host is exclusive with networks/expose, so those are removed.
+    network_mode: host
     volumes:
       - /proc:/host/proc:ro
       - /sys:/host/sys:ro
@@ -220,10 +224,6 @@ services:
       - '--path.sysfs=/host/sys'
       - '--collector.filesystem.ignored-mount-points=^/(sys|proc|dev|host|etc)($$|/)'
     restart: unless-stopped
-    expose:
-      - 9100
-    networks:
-      - chains
     labels:
       - "prometheus-scrape.enabled=true"
       - "prometheus-scrape.port=9100"