diff --git a/apps/victoria-metrics.yaml b/apps/victoria-metrics.yaml
new file mode 100644
index 0000000..64c2082
--- /dev/null
+++ b/apps/victoria-metrics.yaml
@@ -0,0 +1,41 @@
+# Cluster metrics collection for the external VictoriaMetrics and Grafana host.
+# This Application installs only collectors and Kubernetes exporters: metrics
+# are sent over NetBird to prd-vps-hel-01 and are not stored in this cluster.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: victoria-metrics
+  namespace: argocd
+  # The in-cluster pieces are stateless. Cascading deletion is safe because the
+  # durable metrics database lives on the external VPS, not in this namespace.
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/victoria-metrics
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    # node-exporter reads host kernel and filesystem metrics through hostPath,
+    # hostNetwork, and hostPID. Scope the required privileged Pod Security
+    # profile to this dedicated monitoring namespace.
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
+        pod-security.kubernetes.io/audit: privileged
+        pod-security.kubernetes.io/warn: privileged
+    syncOptions:
+      - CreateNamespace=true
+      # VictoriaMetrics Operator CRDs are large. Server-side apply avoids the
+      # client-side last-applied annotation size limit and handles CRDs first.
+      - ServerSideApply=true
diff --git a/apps/victoria-metrics/Chart.yaml b/apps/victoria-metrics/Chart.yaml
new file mode 100644
index 0000000..11fdca4
--- /dev/null
+++ b/apps/victoria-metrics/Chart.yaml
@@ -0,0 +1,13 @@
+# Umbrella chart for the official VictoriaMetrics Kubernetes monitoring stack.
+# Argo CD renders this dependency from Git just like the existing Longhorn and
+# MetalLB wrapper charts.
+apiVersion: v2
+name: victoria-metrics-app
+description: Forwards Kubernetes and node metrics to external VictoriaMetrics
+version: 0.1.0
+dependencies:
+  - name: victoria-metrics-k8s-stack
+    # Pin the exact chart version so monitoring upgrades are explicit and
+    # reviewable rather than changing during an unrelated Argo CD sync.
+    version: 0.96.0
+    repository: oci://ghcr.io/victoriametrics/helm-charts
diff --git a/apps/victoria-metrics/values.yaml b/apps/victoria-metrics/values.yaml
new file mode 100644
index 0000000..28cd91d
--- /dev/null
+++ b/apps/victoria-metrics/values.yaml
@@ -0,0 +1,74 @@
+# Values for the upstream victoria-metrics-k8s-stack dependency. This cluster
+# collects metrics only; durable storage and visualization run on the NetBird-
+# connected VPS at 100.71.24.9.
+victoria-metrics-k8s-stack:
+  # Identify this source if more clusters write to the same database later.
+  vmagent:
+    enabled: true
+    spec:
+      scrapeInterval: 30s
+      externalLabels:
+        cluster: gitops-starter
+      resources:
+        requests:
+          cpu: 100m
+          memory: 128Mi
+        limits:
+          memory: 512Mi
+
+  external:
+    vm:
+      # Queries are served from the VictoriaMetrics base URL. Remote write uses
+      # its Prometheus-compatible ingestion endpoint. NetBird encrypts the path
+      # between the Talos nodes and VPS, so no public endpoint is involved.
+      read:
+        url: http://100.71.24.9:8428
+      write:
+        url: http://100.71.24.9:8428/api/v1/write
+
+  # Storage and UI already live on prd-vps-hel-01; do not duplicate them here.
+  vmsingle:
+    enabled: false
+  vmcluster:
+    enabled: false
+  vmdistributed:
+    enabled: false
+  grafana:
+    enabled: false
+
+  # Alert delivery is a separate follow-up once notification destinations are
+  # chosen. Disabling it also avoids deploying rules with nowhere to notify.
+  vmalert:
+    enabled: false
+  alertmanager:
+    enabled: false
+  defaultRules:
+    enabled: false
+  defaultDashboards:
+    enabled: false
+
+  # One node-exporter Pod runs on every node, including tainted control planes.
+  # Talos exposes the host root filesystem read-only; mount propagation is not
+  # needed and can be rejected by immutable hosts, so keep it disabled.
+  prometheus-node-exporter:
+    enabled: true
+    hostRootFsMount:
+      enabled: true
+      mountPropagation: None
+    resources:
+      requests:
+        cpu: 20m
+        memory: 32Mi
+      limits:
+        memory: 128Mi
+
+  # kube-state-metrics reports desired/current Kubernetes object state (for
+  # example unavailable Deployment replicas), complementing host metrics.
+  kube-state-metrics:
+    enabled: true
+    resources:
+      requests:
+        cpu: 20m
+        memory: 64Mi
+      limits:
+        memory: 256Mi