diff --git a/deploy/Makefile b/deploy/Makefile
index 652a16a..b187589 100644
--- a/deploy/Makefile
+++ b/deploy/Makefile
@@ -7,9 +7,9 @@ prod: load-prod-env
 	# go install https://git.netflux.io/rob/envfilesubst@latest
 	@kubectl kustomize --enable-helm prod | envfilesubst -f prod/secrets/env
 
-prod-ovh:
+prod-ovh: load-prod-ovh-env
 	# go install https://git.netflux.io/rob/envfilesubst@latest
-	@kubectl kustomize --enable-helm prod-ovh
+	@kubectl kustomize --enable-helm prod-ovh | envfilesubst -f prod-ovh/secrets/env
 
 cert-manager:
 	@kubectl kustomize --enable-helm cert-manager
@@ -21,6 +21,10 @@ load-prod-env:
 	$(eval include prod/secrets/env)
 	$(eval export)
 
+load-prod-ovh-env:
+	$(eval include prod-ovh/secrets/env)
+	$(eval export)
+
 # Usage: make inflate name=prometheus chart=prometheus-community/prometheus [base=dev]
 base=base
 namespace=default
diff --git a/deploy/prod-ovh/kustomization.yaml b/deploy/prod-ovh/kustomization.yaml
index c4db7cc..a6b4b8f 100644
--- a/deploy/prod-ovh/kustomization.yaml
+++ b/deploy/prod-ovh/kustomization.yaml
@@ -69,7 +69,7 @@ secretGenerator:
 
 patches:
 # Patch Grafana deployment to inject PostgreSQL credentials:
-# - target:
-#     kind: Deployment
-#     name: grafana
-#   path: deploy-grafana.yaml
+- target:
+    kind: Deployment
+    name: grafana
+  path: deploy-grafana.yaml
diff --git a/deploy/prod-ovh/resources/grafana-contactpoints.yaml b/deploy/prod-ovh/resources/grafana-contactpoints.yaml
index 417c64b..5122976 100644
--- a/deploy/prod-ovh/resources/grafana-contactpoints.yaml
+++ b/deploy/prod-ovh/resources/grafana-contactpoints.yaml
@@ -6,4 +6,4 @@ contactPoints:
     type: prometheus-alertmanager
     disableResolveMessage: false
     settings:
-      url: http://prod-prometheus-alertmanager:9093
+      url: http://prod-prometheus-alertmanager.prometheus:9093