diff --git a/terraform/hetzner/prod/firewall.tf b/terraform/hetzner/prod/firewall.tf
index ac66bfe..7fb6e50 100644
--- a/terraform/hetzner/prod/firewall.tf
+++ b/terraform/hetzner/prod/firewall.tf
@@ -161,6 +161,13 @@ resource "hcloud_firewall" "app" {
     description = "Grafana — private, via SWAG on 443 (IP restricted)"
   }
 
+  rule {
+    direction   = "in"
+    protocol    = "icmp"
+    source_ips  = var.monitoring_cidrs
+    description = "ICMP ping from Uptime Kuma monitoring server"
+  }
+
   labels = {
     environment = local.environment
     role        = "app"
@@ -274,6 +281,13 @@ resource "hcloud_firewall" "db" {
     description = "Patroni REST API within DB subnet"
   }
 
+  rule {
+    direction   = "in"
+    protocol    = "icmp"
+    source_ips  = var.monitoring_cidrs
+    description = "ICMP ping from Uptime Kuma monitoring server"
+  }
+
   labels = {
     environment = local.environment
     role        = "db"
diff --git a/terraform/hetzner/prod/variables.tf b/terraform/hetzner/prod/variables.tf
index 2b746fd..9ef19eb 100644
--- a/terraform/hetzner/prod/variables.tf
+++ b/terraform/hetzner/prod/variables.tf
@@ -38,3 +38,9 @@ variable "admin_allowed_cidrs" {
   type        = list(string)
   description = "CIDR list for admin SSH access"
 }
+
+variable "monitoring_cidrs" {
+  type        = list(string)
+  default     = ["91.99.57.252/32"]
+  description = "CIDR list for the Uptime Kuma monitoring server (ICMP ping allowed)"
+}
diff --git a/terraform/hetzner/test/firewall.tf b/terraform/hetzner/test/firewall.tf
index 3526cea..7cc01fe 100644
--- a/terraform/hetzner/test/firewall.tf
+++ b/terraform/hetzner/test/firewall.tf
@@ -169,6 +169,13 @@ resource "hcloud_firewall" "app" {
     description = "Grafana — private, via SWAG on 443"
   }
 
+  rule {
+    direction   = "in"
+    protocol    = "icmp"
+    source_ips  = var.monitoring_cidrs
+    description = "ICMP ping from Uptime Kuma monitoring server"
+  }
+
   labels = {
     environment = local.environment
     role        = "app"
@@ -242,6 +249,13 @@ resource "hcloud_firewall" "db" {
     description = "Docker Swarm VXLAN overlay from app subnet"
   }
 
+  rule {
+    direction   = "in"
+    protocol    = "icmp"
+    source_ips  = var.monitoring_cidrs
+    description = "ICMP ping from Uptime Kuma monitoring server"
+  }
+
   labels = {
     environment = local.environment
     role        = "db"
diff --git a/terraform/hetzner/test/variables.tf b/terraform/hetzner/test/variables.tf
index 083f4c0..bffb69a 100644
--- a/terraform/hetzner/test/variables.tf
+++ b/terraform/hetzner/test/variables.tf
@@ -38,3 +38,9 @@ variable "admin_allowed_cidrs" {
   type        = list(string)
   description = "CIDR list for admin SSH and management port access"
 }
+
+variable "monitoring_cidrs" {
+  type        = list(string)
+  default     = ["91.99.57.252/32"]
+  description = "CIDR list for the Uptime Kuma monitoring server (ICMP ping allowed)"
+}