diff --git a/stacks/monitoring/modules/monitoring/alloy.yaml b/stacks/monitoring/modules/monitoring/alloy.yaml
index a938a29a..d2f9602d 100644
--- a/stacks/monitoring/modules/monitoring/alloy.yaml
+++ b/stacks/monitoring/modules/monitoring/alloy.yaml
@@ -37,6 +37,19 @@ alloy:
       discovery.relabel "pod_logs" {
         targets = discovery.kubernetes.pod.targets
 
+        // Drop high-volume, low-value producers from Loki to cut sdc write wear
+        // (the log PVC is on the contended sdc HDD). goflow2 emits one JSON line
+        // per NetFlow record to stdout (~8 GB/day, ~64% of all cluster logs) but
+        // we only use its Prometheus aggregate metrics, not the per-flow logs;
+        // vpa = Goldilocks/VPA recommender chatter (~1.3 GB/day). Both reversible
+        // — remove this rule to ship them again. (Added 2026-06-05.)
+        rule {
+          source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_name"]
+          separator     = "/"
+          regex         = "monitoring/goflow2-.*|vpa/.*"
+          action        = "drop"
+        }
+
         // Label creation - "namespace" field from "__meta_kubernetes_namespace"
         rule {
           source_labels = ["__meta_kubernetes_namespace"]