diff --git a/secretstores/grafana-admin-credentials.yaml b/secretstores/grafana-admin-credentials.yaml
new file mode 100644
index 0000000..c1df36b
--- /dev/null
+++ b/secretstores/grafana-admin-credentials.yaml
@@ -0,0 +1,41 @@
+# Grafana's admin login, from Vault — same pattern as every other admin
+# credential in this repo (gitea-admin-credentials, harbor-admin-credentials,
+# jenkins-admin-credentials).
+#
+# Put the credential in Vault BEFORE syncing this. External Secrets cannot
+# create a Secret for a path that does not exist, and Grafana will start with
+# a randomly-generated admin password nobody has if this Secret is missing
+# when it first boots (the chart's own fallback, not a failure to start —
+# worth knowing so a missing Secret doesn't look like a crash):
+#
+#   kubectl -n vault exec -i vault-0 -- sh -lc '
+#     vault login <root-token> >/dev/null &&
+#     vault kv put secret/grafana/admin \
+#       username=admin \
+#       password=<a long alphanumeric password>'
+#
+# Remember that `kubectl exec` into Vault is unauthenticated by default —
+# without the `vault login` the commands fail with a "preflight capability
+# check" error that reads like a permissions bug rather than a missing login.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grafana-admin-credentials
+  namespace: monitoring
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: grafana-admin-credentials
+    creationPolicy: Owner
+  data:
+    - secretKey: username
+      remoteRef:
+        key: grafana/admin
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: grafana/admin
+        property: password
diff --git a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
index bcb53cd..a00678a 100644
--- a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
+++ b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml
@@ -176,4 +176,21 @@ appSpec:
     nameOverride: node-exporter
     namespace: monitoring
     chartDir: node-exporter
-    valuesDir: node-exporter
\ No newline at end of file
+    valuesDir: node-exporter
+  - name: grafana
+    # Dashboards over VictoriaMetrics — see that chart for why "type:
+    # prometheus" is correct for a VictoriaMetrics URL. This directory
+    # already held a fully-vendored old Grafana chart (v6.58.7) from the
+    # original Meesho monorepo import with generic production config
+    # (fullnameOverride: grafana-infra-prd) — removed and re-vendored
+    # fresh as a thin wrapper, same treatment as victoria-metrics-single.
+    #
+    # Requires secretstores/grafana-admin-credentials.yaml to have synced
+    # first — the pod falls back to a randomly-generated admin password
+    # nobody has if that Secret does not exist yet when it boots (not a
+    # crash, just an inaccessible login until the Secret exists and the
+    # pod restarts).
+    nameOverride: grafana
+    namespace: monitoring
+    chartDir: grafana
+    valuesDir: grafana
\ No newline at end of file