diff --git a/hosts/idols-aquamarine/postgresql.nix b/hosts/idols-aquamarine/postgresql.nix
index 138bb97b..5c864e7d 100644
--- a/hosts/idols-aquamarine/postgresql.nix
+++ b/hosts/idols-aquamarine/postgresql.nix
@@ -121,7 +121,8 @@ in
 
   services.prometheus.exporters.postgres = {
     enable = true;
-    listenAddress = "0.0.0.0";
+    # loopback only: scraped by VictoriaMetrics on the same host
+    listenAddress = "127.0.0.1";
     port = 9187;
     user = "postgres-exporter";
     group = "postgres-exporter";
diff --git a/hosts/idols-aquamarine/proxy.nix b/hosts/idols-aquamarine/proxy.nix
index 67a22376..3bab4087 100644
--- a/hosts/idols-aquamarine/proxy.nix
+++ b/hosts/idols-aquamarine/proxy.nix
@@ -82,7 +82,8 @@
   # https://github.com/wi1dcard/v2ray-exporter
   services.prometheus.exporters.v2ray = {
     enable = true;
-    listenAddress = "0.0.0.0";
+    # loopback only: scraped by VictoriaMetrics on the same host
+    listenAddress = "127.0.0.1";
     port = 9153;
     openFirewall = false;
     v2rayEndpoint = "127.0.0.1:54321";
diff --git a/hosts/idols-aquamarine/sftpgo.nix b/hosts/idols-aquamarine/sftpgo.nix
index e7a0d4b9..da3841b1 100644
--- a/hosts/idols-aquamarine/sftpgo.nix
+++ b/hosts/idols-aquamarine/sftpgo.nix
@@ -95,7 +95,8 @@ in
       # prometheus metrics
       telemetry = {
         bind_port = 10000;
-        bind_address = "0.0.0.0";
+        # loopback only: scraped by VictoriaMetrics on the same host
+        bind_address = "127.0.0.1";
         # auth_user_file = "";
       };
       # multi-factor authentication settings
diff --git a/outputs/x86_64-linux/tests/security-aquamarine-metrics/expected.nix b/outputs/x86_64-linux/tests/security-aquamarine-metrics/expected.nix
new file mode 100644
index 00000000..c45419fd
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-aquamarine-metrics/expected.nix
@@ -0,0 +1,9 @@
+{
+  lib,
+  outputs,
+}:
+{
+  v2rayExporter = "127.0.0.1";
+  pgExporter = "127.0.0.1";
+  sftpgoTelemetry = "127.0.0.1";
+}
diff --git a/outputs/x86_64-linux/tests/security-aquamarine-metrics/expr.nix b/outputs/x86_64-linux/tests/security-aquamarine-metrics/expr.nix
new file mode 100644
index 00000000..3d99fe60
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-aquamarine-metrics/expr.nix
@@ -0,0 +1,12 @@
+{
+  lib,
+  outputs,
+}:
+let
+  aqua = outputs.nixosConfigurations.aquamarine.config;
+in
+{
+  v2rayExporter = aqua.services.prometheus.exporters.v2ray.listenAddress;
+  pgExporter = aqua.services.prometheus.exporters.postgres.listenAddress;
+  sftpgoTelemetry = aqua.services.sftpgo.settings.telemetry.bind_address;
+}