diff --git a/hosts/unstable/genesis/net/hosts b/hosts/unstable/genesis/net/hosts
index d529bd6..4831727 100644
--- a/hosts/unstable/genesis/net/hosts
+++ b/hosts/unstable/genesis/net/hosts
@@ -1,5 +1,6 @@
 # Local hosts
 10.42.0.1 switch switch.thehellings.lan  # Core switch for the network
+10.42.0.3 ap ap.thehellings.lan  # OpenWRT access point (static IP)
 10.42.0.4 joel.thehellings.lan  # Proxmox
 10.42.0.5 sanswitch.thehellings.lan  # Core switch for the SAN
 
diff --git a/hosts/unstable/genesis/networking.nix b/hosts/unstable/genesis/networking.nix
index 417c648..f461249 100644
--- a/hosts/unstable/genesis/networking.nix
+++ b/hosts/unstable/genesis/networking.nix
@@ -112,6 +112,18 @@ in
 
     prometheus.exporters = {
       dnsmasq.enable = true;
+      blackbox = {
+        enable = true;
+        openFirewall = true;
+        configFile = pkgs.writeText "blackbox.yml" ''
+          modules:
+            icmp:
+              prober: icmp
+              timeout: 5s
+              icmp:
+                preferred_ip_protocol: ip4
+        '';
+      };
     };
   }; # End of services configuration
 
diff --git a/manifests/monitoring/config.yaml b/manifests/monitoring/config.yaml
index e69af91..471d317 100644
--- a/manifests/monitoring/config.yaml
+++ b/manifests/monitoring/config.yaml
@@ -43,6 +43,29 @@ data:
               - "hosea.shire-zebra.ts.net:9427"
               - "exodus.shire-zebra.ts.net:9427"
               - "linode.shire-zebra.ts.net:9427"
+      # ICMP ping reachability for non-NixOS infrastructure
+      - job_name: infra_ping
+        metrics_path: /probe
+        params:
+          module: [icmp]
+        static_configs:
+          - targets:
+              - "10.42.0.3"    # OpenWRT access point
+              - "10.42.0.4"    # Joel (Proxmox)
+              - "10.42.1.1"    # pve1 (Proxmox)
+              - "10.42.1.4"    # chronicles (Synology NAS)
+              - "10.42.1.14"   # nas1 (TrueNAS)
+              - "10.42.2.57"   # odoo
+              - "10.42.2.89"   # mattermost
+              - "10.42.2.155"  # homeassistant
+              - "10.42.3.58"   # USW-Pro-HD-24 (UniFi switch)
+        relabel_configs:
+          - source_labels: [__address__]
+            target_label: __param_target
+          - source_labels: [__param_target]
+            target_label: instance
+          - target_label: __address__
+            replacement: "genesis.shire-zebra.ts.net:9115"
       - job_name: kea
         static_configs:
           - targets:
diff --git a/manifests/monitoring/unpoller.yaml b/manifests/monitoring/unpoller.yaml
index 5c83f58..7603fc5 100644
--- a/manifests/monitoring/unpoller.yaml
+++ b/manifests/monitoring/unpoller.yaml
@@ -1,13 +1,29 @@
 ---
-apiVersion: v1
-kind: Secret
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: unpoller-credentials
-  namespace: monitoring
-type: Opaque
-stringData:
-  # Replace with actual UniFi controller password for the 'unpoller' read-only user
-  password: "CHANGEME"
+spec:
+  target:
+    name: unpoller-credentials
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    - secretKey: username
+      remoteRef:
+        key: "15bfc957-5de5-49b2-ab6c-b41800e71564"
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: "15bfc957-5de5-49b2-ab6c-b41800e71564"
+        property: password
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -38,7 +54,10 @@ spec:
             - name: UP_UNIFI_DEFAULT_VERIFY_SSL
               value: "false"
             - name: UP_UNIFI_DEFAULT_USER
-              value: "unpoller"
+              valueFrom:
+                secretKeyRef:
+                  name: unpoller-credentials
+                  key: username
             - name: UP_UNIFI_DEFAULT_PASS
               valueFrom:
                 secretKeyRef: