diff --git a/stacks/_templates/prometheus-service-monitor.yaml b/stacks/_templates/prometheus-service-monitor.yaml
index 3d597a7b..c146a002 100644
--- a/stacks/_templates/prometheus-service-monitor.yaml
+++ b/stacks/_templates/prometheus-service-monitor.yaml
@@ -18,6 +18,38 @@ spec:
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
+metadata:
+  name: scrape-nifi
+  labels:
+    stackable.tech/vendor: Stackable
+    release: prometheus
+spec:
+  endpoints:
+  - path: /nifi-api/flow/metrics/prometheus
+    port: https
+    scheme: https
+    tlsConfig:
+      caFile: /stackable/tls/ca.crt
+      certFile: /stackable/tls/tls.crt
+      keyFile: /stackable/tls/tls.key
+    relabelings:
+      - sourceLabels:
+          - __meta_kubernetes_pod_name
+          - __meta_kubernetes_service_name
+          - __meta_kubernetes_namespace
+          - __meta_kubernetes_pod_container_port_number
+        targetLabel: __address__
+        replacement: ${1}.${2}.${3}.svc.cluster.local:${4}
+        regex: (.+);(.+?)(?:-headless)?;(.+);(.+)
+  selector:
+    matchLabels:
+      prometheus.io/scrape: "true"
+  namespaceSelector:
+    any: true
+  jobLabel: app.kubernetes.io/instance
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
 metadata:
   name: scrape-minio
   labels:
diff --git a/stacks/_templates/prometheus.yaml b/stacks/_templates/prometheus.yaml
index 91c0c8c2..18792b02 100644
--- a/stacks/_templates/prometheus.yaml
+++ b/stacks/_templates/prometheus.yaml
@@ -10,6 +10,24 @@ options:
     stackable.tech/vendor: Stackable
   prometheus:
     prometheusSpec:
+      volumes:
+        - name: tls
+          ephemeral:
+            volumeClaimTemplate:
+              metadata:
+                annotations:
+                  secrets.stackable.tech/class: tls
+                  secrets.stackable.tech/scope: pod,service=prometheus-kube-prometheus-prometheus
+              spec:
+                storageClassName: secrets.stackable.tech
+                accessModes:
+                  - ReadWriteOnce
+                resources:
+                  requests:
+                    storage: "1"
+      volumeMounts:
+        - name: tls
+          mountPath: /stackable/tls
       storageSpec:
         volumeClaimTemplate:
           spec: