diff --git a/dankclaw/observability/quadlet/blackbox-exporter.container b/dankclaw/observability/quadlet/blackbox-exporter.container
index d6c2405..5d5b9f6 100644
--- a/dankclaw/observability/quadlet/blackbox-exporter.container
+++ b/dankclaw/observability/quadlet/blackbox-exporter.container
@@ -18,9 +18,11 @@
 # clients. The podman gateway (169.254.1.2 = host.containers.internal) is the
 # address bridge containers reach same-host targets at, so the exporter binds
 # it explicitly for the scrape rather than relying on loopback-forwarding
-# semantics, and keeps the LAN bind for its own healthcheck and diagnostics.
-# No public DNS name, no guard chain: internal net only, per the exposure
-# policy.
+# semantics, and keeps the LAN bind for diagnostics. No public DNS name, no
+# guard chain: internal net only, per the exposure policy. The listen flag is
+# --web.listen-address and it is REPEATABLE, one flag per bind; plain
+# --listen-address does not exist and the exporter exits in 100 ms with
+# "unknown long flag" (live 2026-10-21).
 
 [Unit]
 Description=Blackbox exporter (HTTP probe prober)
@@ -30,7 +32,7 @@ After=network-online.target
 Image=docker.io/prom/blackbox-exporter@sha256:ea1c7aa3ef3f307cd03e85f34abb604478ccb90b567fc690da0cd9776da76b13
 ContainerName=blackbox-exporter
 Network=host
-Exec=/bin/blackbox_exporter --config.file=/etc/blackbox_exporter/config.yml --listen-address=192.168.0.143:9115,169.254.1.2:9115
+Exec=/bin/blackbox_exporter --config.file=/etc/blackbox_exporter/config.yml --web.listen-address=192.168.0.143:9115 --web.listen-address=169.254.1.2:9115
 Volume=/opt/blackbox/blackbox.yml:/etc/blackbox_exporter/config.yml:ro
 HealthCmd=/bin/sh -c "wget -q -O /dev/null http://169.254.1.2:9115/-/healthy || exit 1"
 HealthInterval=30s