@@ -207,8 +207,8 @@ trend charts remain unavailable for Kubecost.
 | `cost.kubecost.existingSecret` | Secret holding an optional Kubecost service-account API key; setting it disables automatic port-9008 auth bypass | `""` |
 | `cost.kubecost.existingSecretKey` | Key within `cost.kubecost.existingSecret`; sent as `X-API-KEY` | `api-key` |
 | `traffic.prometheusUrl` | Manual Prometheus/VictoriaMetrics URL (skips auto-discovery) | `""` |
-| `traffic.prometheusHeaders` | HTTP headers sent with every Prometheus request (auth-protected backends) | `{}` |
-| `traffic.prometheusHeadersFromEnv` | Prometheus headers sourced from environment variables, for secret-backed auth headers | `{}` |
+| `traffic.prometheusHeaders` | HTTP headers sent with every Prometheus request (auth-protected backends). Requires `traffic.prometheusUrl` — credentials are never sent to auto-discovered endpoints | `{}` |
+| `traffic.prometheusHeadersFromEnv` | Prometheus headers sourced from environment variables, for secret-backed auth headers. Requires `traffic.prometheusUrl` | `{}` |
 | `argocd.existingSecret` | Name of a Secret holding the Argo CD API token (recommended — keeps it out of the release) | `""` |
 | `argocd.existingSecretKey` | Key within `argocd.existingSecret` holding the token | `token` |
 | `argocd.token` | Inline Argo CD API token (dev only — lands in the release state) | `""` |
 
@@ -362,7 +362,17 @@
           "type": "object",
           "additionalProperties": { "type": "string" }
         }
-      }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "prometheusHeaders": { "minProperties": 1 } }, "required": ["prometheusHeaders"] },
+          "then": { "properties": { "prometheusUrl": { "pattern": "\\S" } }, "required": ["prometheusUrl"] }
+        },
+        {
+          "if": { "properties": { "prometheusHeadersFromEnv": { "minProperties": 1 } }, "required": ["prometheusHeadersFromEnv"] },
+          "then": { "properties": { "prometheusUrl": { "pattern": "\\S" } }, "required": ["prometheusUrl"] }
+        }
+      ]
     },
     "argocd": {
       "type": "object",
 
@@ -533,6 +533,8 @@ traffic:
   prometheusUrl: ""
   # HTTP headers sent with every Prometheus request. Required for
   # auth-protected backends (Bearer tokens, X-Scope-OrgID multi-tenancy, etc.).
+  # Setting headers requires prometheusUrl: Radar never sends credentials to
+  # auto-discovered endpoints, and the chart schema rejects the combination.
   # Values are rendered into the pod spec; use prometheusHeadersFromEnv for
   # secrets.
   # Example:
 
@@ -111,11 +111,11 @@ All fields are optional — omitted fields use built-in defaults.
 | `kubecostUrl` | Optional Kubecost 3 Aggregator base URL. Empty discovers an active local Aggregator Service and tries its named `tcp-api` port (9004). When that port requires SAML/OIDC and no API key is configured, Radar can fall back to the same Service's exact `tcp-api-rbac` port (9008). Federated agent-only clusters need the central URL; root API URLs and URLs ending in `/model` are accepted. |
 | `kubecostClusterId` | Cluster ID used to filter a central Aggregator. Empty detects one distinct literal `CLUSTER_ID` from an active FinOps Agent or Aggregator; indirect or conflicting values require an override. An override saved in Settings is bound to the active kubeconfig context so switching clusters cannot silently reuse the wrong cluster's costs. A value added directly to the config file is bound and persisted on its first startup with an available kubeconfig context. |
 | `kubecostApiKey` | Optional Kubecost service-account key sent as `X-API-KEY`. Stored in the unencrypted `0600` config file and redacted from `GET /api/config`; changing the URL origin clears a stored key unless it is supplied again. With a blank URL, a key saved in Settings is bound to the active kubeconfig context because Radar will auto-discover that cluster's local Aggregator; a key added directly to the config file is bound and persisted on its first startup with an available kubeconfig context. An explicit key is never bypassed through an auto-discovered unauthenticated port: authentication failure remains visible. A key paired with an explicit central Aggregator URL can be reused across contexts. In the Helm deployment, the UI-written config lives on the pod's temporary `emptyDir` and does not survive pod replacement; use a Kubernetes Secret with `cost.kubecost.existingSecret` instead. |
-| `prometheusHeaders` | HTTP headers sent with every Prometheus request. Required for auth-protected backends — e.g. `{"X-Scope-OrgID": "my-org"}`. Equivalent CLI: `--prometheus-header Key=Value` (repeatable). Stored in plain text in `config.json` — protect the file accordingly. |
+| `prometheusHeaders` | HTTP headers sent with every Prometheus request. Required for auth-protected backends — e.g. `{"X-Scope-OrgID": "my-org"}`. Equivalent CLI: `--prometheus-header Key=Value` (repeatable). Stored in plain text in `config.json` — protect the file accordingly. **Requires `prometheusUrl`**: headers carry credentials, and auto-discovery probes every Service that looks like Prometheus, so with headers configured and no URL Radar refuses to discover (the Metrics status names the rule) rather than send them to endpoints you never named. Settings rejects saving that combination. |
 | `argoCdUrl` | Manual argocd-server URL for the Argo CD API integration — skips auto-discovery. |
 | `argoCdToken` | Argo CD API token (get-only account recommended). Stored in plain text — the file is written `0600`; the token is redacted from `GET /api/config`. |
 | `argoCdInsecureTls` | Skip TLS verification for argocd-server (self-signed default installs). Scoped to the Argo CD client only. |
-| `prometheusHeadersFromEnv` | Header values read from environment variables at startup — e.g. `{"Authorization": "PROMETHEUS_TOKEN"}`. Equivalent CLI: `--prometheus-header-from-env Key=ENV_VAR` (repeatable). Use this with Kubernetes Secret-backed env vars in Helm deployments. |
+| `prometheusHeadersFromEnv` | Header values read from environment variables at startup — e.g. `{"Authorization": "PROMETHEUS_TOKEN"}`. Equivalent CLI: `--prometheus-header-from-env Key=ENV_VAR` (repeatable). Use this with Kubernetes Secret-backed env vars in Helm deployments. Same rule as `prometheusHeaders`: requires `prometheusUrl`. |
 | `mcp` | Enable/disable MCP server for AI tools (default: enabled) |
 | `debugImage` | Image for ephemeral debug containers and node debug pods (same as `--debug-image`). Empty = `busybox:latest`; point at a mirror for air-gapped / private-registry clusters. |
 
 
@@ -522,8 +522,8 @@ See [Helm Chart README](../deploy/helm/radar/README.md) for all available values
 | `cost.kubecost.url` | Kubecost 3 Aggregator URL; blank discovers local port 9004 and may fall back to the named SAML/OIDC bypass port 9008 without a key; required for agent-only clusters | `""` (discover local) |
 | `cost.kubecost.clusterId` | Cluster ID filter for a central Aggregator | `""` (detect literal `CLUSTER_ID`) |
 | `cost.kubecost.existingSecret` | Secret containing an optional Kubecost API key; setting it disables automatic port-9008 auth bypass | `""` |
-| `traffic.prometheusUrl` | Manual PromQL-compatible query URL (Prometheus, VictoriaMetrics, Thanos, Mimir) | `""` (auto-discover) |
-| `traffic.prometheusHeadersFromEnv` | Prometheus headers sourced from environment variables, for secret-backed auth headers | `{}` |
+| `traffic.prometheusUrl` | Manual PromQL-compatible query URL (Prometheus, VictoriaMetrics, Thanos, Mimir). Required whenever headers are set | `""` (auto-discover) |
+| `traffic.prometheusHeadersFromEnv` | Prometheus headers sourced from environment variables, for secret-backed auth headers. Requires `traffic.prometheusUrl` — credentials are never sent to auto-discovered endpoints | `{}` |
 | `persistence.enabled` | Enable PVC for SQLite storage | `false` |
 | `persistence.size` | PVC size | `1Gi` |
 | `rbac.podLogs` | Enable log viewer | `true` |
@@ -557,6 +557,14 @@ kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx
 
 If the UI loads through an ingress but pod exec does not connect, ensure the ingress forwards WebSocket upgrades and preserves the browser-facing `Host` header. Preserving `Host` is the compatibility requirement across browsers and proxies; Fetch Metadata is an additional signal only when both sides forward it. Radar logs rejected handshakes with both `Origin` and `Host`.
 
+### Metrics charts show "Prometheus not connected"
+
+Radar discovers Prometheus in the background as soon as it connects to the cluster (and again after every context switch), by listing Services and probing the ones that look like a PromQL backend at their in-cluster address. While that runs the charts show "Discovering Prometheus…"; once it ends without a connection, the charts and **Settings → Overview → Metrics** show why:
+
+- *no Prometheus service found in cluster* — nothing matched the well-known names or labels. Set `traffic.prometheusUrl`.
+- *no Prometheus service reachable in cluster* — a candidate exists but its Service address did not answer from Radar's pod. In-cluster Radar does not fall back to port-forwarding, so a NetworkPolicy or mesh rule that blocks Radar's namespace from the monitoring namespace shows up exactly like this. Allow ingress from Radar's namespace, or point `traffic.prometheusUrl` at an address that is reachable.
+- *Prometheus headers are configured but no Prometheus URL is set* — see `traffic.prometheusHeadersFromEnv` above.
+
 ### Basic auth prompt not appearing
 
 Verify the secret format:
 
@@ -29,6 +29,7 @@ import (
 	"github.com/skyhook-io/radar/internal/timeline"
 	"github.com/skyhook-io/radar/internal/traffic"
 	versionpkg "github.com/skyhook-io/radar/internal/version"
+	"github.com/skyhook-io/radar/pkg/prom"
 )
 
 var clusterConnectionProbe = k8s.TestClusterConnection
@@ -292,6 +293,9 @@ func RegisterCallbacks(cfg AppConfig, timelineStoreCfg timeline.StoreConfig) {
 	if len(cfg.PrometheusHeaders) > 0 {
 		traffic.SetMetricsHeaders(cfg.PrometheusHeaders)
 		prometheuspkg.SetHeaders(cfg.PrometheusHeaders)
+		if prom.HeadersRequireURL(cfg.PrometheusURL, cfg.PrometheusHeaders) {
+			log.Printf("[prometheus] Warning: %v", prom.ErrHeadersRequireURL)
+		}
 	}
 	cfg = persistKubecostContextBindings(cfg)
 	if err := internalopencost.ConfigureStartup(internalopencost.ManagerConfig{
@@ -319,6 +323,11 @@ func RegisterCallbacks(cfg AppConfig, timelineStoreCfg timeline.StoreConfig) {
 		prometheuspkg.Reinitialize(k8s.GetClient(), k8s.GetConfig(), k8s.GetContextName())
 		return nil
 	})
+	// Reinitialize only builds the new client; discovery for the new cluster has
+	// to be started explicitly, and the callback fires once subsystem init is
+	// done so the run sees a populated cache.
+	k8s.OnContextSwitch(func(_ string) { prometheuspkg.Prewarm() })
+	k8s.OnNamespaceRescope(func(_ string) { prometheuspkg.Prewarm() })
 	k8s.RegisterCostResetFunc(internalopencost.Reset)
 }
 
@@ -578,21 +587,7 @@ func InitializeCluster() {
 		ClusterName: k8s.GetClusterName(),
 	})
 
-	// Auto-discover Prometheus in the background so charts are ready immediately
-	go func() {
-		pt := time.Now()
-		promCtx, promCancel := context.WithTimeout(context.Background(), 30*time.Second)
-		defer promCancel()
-		client := prometheuspkg.GetClient()
-		if client == nil {
-			return
-		}
-		if _, _, err := client.EnsureConnected(promCtx); err != nil {
-			log.Printf("[prometheus] Auto-discovery failed (%v): %v", time.Since(pt), err)
-		} else {
-			log.Printf("[prometheus] Auto-discovery succeeded (%v)", time.Since(pt))
-		}
-	}()
+	prometheuspkg.Prewarm()
 }
 
 // mcpPortFileDisabled suppresses port-file writes AND removals — an ephemeral
 
@@ -268,6 +268,32 @@ func RegisterTrafficFuncs(reset TrafficResetFunc, reinit TrafficReinitFunc) {
 	trafficReinitFunc = reinit
 }
 
+// RestartTrafficSubsystem tears down and rebuilds the traffic manager for the
+// current cluster, the way a context switch does, serialized with any switch
+// or rescope in flight so the two can't interleave on the manager singleton.
+// A live configuration change that the traffic sources copied at construction
+// (the metrics URL and headers) reaches them only this way. No-op while
+// disconnected: the next connect builds the manager from current config.
+func RestartTrafficSubsystem() error {
+	contextSwitchMu.RLock()
+	resetFn, reinitFn := trafficResetFunc, trafficReinitFunc
+	contextSwitchMu.RUnlock()
+	if resetFn == nil || reinitFn == nil {
+		return nil
+	}
+	activeContextOperations.Add(1)
+	contextOpMu.Lock()
+	defer func() {
+		activeContextOperations.Add(-1)
+		contextOpMu.Unlock()
+	}()
+	if GetClient() == nil {
+		return nil
+	}
+	resetFn()
+	return reinitFn()
+}
+
 // RegisterPrometheusFuncs registers the Prometheus client reset/reinit functions.
 func RegisterPrometheusFuncs(reset PrometheusResetFunc, reinit PrometheusReinitFunc) {
 	contextSwitchMu.Lock()
 
@@ -4,6 +4,8 @@ import (
 	"context"
 	"errors"
 	"strings"
+
+	"github.com/skyhook-io/radar/pkg/prom"
 )
 
 // AvailabilityStatus is the coarse answer to "can Radar reach Prometheus
@@ -83,7 +85,9 @@ func (c *Client) Availability(ctx context.Context) AvailabilityState {
 		// caller's context ends mid-probe: the endpoint is known and only
 		// this probe failed.
 		return AvailabilityState{State: AvailabilityConfiguredFailed, Address: baseURL, Err: err}
-	case errors.Is(err, errPrometheusUnreachable):
+	case errors.Is(err, errPrometheusUnreachable), errors.Is(err, prom.ErrHeadersRequireURL):
+		// Headers without a URL is an operator configuration that discovery
+		// refuses to act on — configured, and failing for a stated reason.
 		return AvailabilityState{State: AvailabilityConfiguredFailed, Err: err}
 	case !hasK8s,
 		errors.Is(err, ErrPrometheusNotFound),