diff --git a/roles/nginx/tasks/exporter.yml b/roles/nginx/tasks/exporter.yml
index a684cbe..245267c 100644
--- a/roles/nginx/tasks/exporter.yml
+++ b/roles/nginx/tasks/exporter.yml
@@ -17,6 +17,9 @@
     mode: "0644"
   notify: Reload nginx
 
+- name: Flush handlers to reload nginx with stub_status
+  ansible.builtin.meta: flush_handlers
+
 - name: Deploy exporter environment file
   ansible.builtin.template:
     src: exporter-env.conf.j2
diff --git a/roles/postgres/README.md b/roles/postgres/README.md
index f82d242..50ffba8 100644
--- a/roles/postgres/README.md
+++ b/roles/postgres/README.md
@@ -92,7 +92,7 @@ via `postgres_exporter`. Enable it:
 
 ```yaml
 postgres_exporter_enabled: true
-postgres_exporter_password: "<min 12 chars>"  # keep URL-safe
+postgres_exporter_password: "<min 12 chars>"  # avoid spaces/single quotes
 ```
 
 The role creates a `postgres_exporter` monitoring role with the built-in
diff --git a/roles/postgres/templates/exporter-env.conf.j2 b/roles/postgres/templates/exporter-env.conf.j2
index 0cfb098..4448498 100644
--- a/roles/postgres/templates/exporter-env.conf.j2
+++ b/roles/postgres/templates/exporter-env.conf.j2
@@ -1,3 +1,3 @@
 # Managed by Ansible - DO NOT EDIT MANUALLY
 {{ postgres_exporter_args_var }}="--web.listen-address={{ postgres_exporter_listen_address }}"
-DATA_SOURCE_NAME="postgresql://{{ postgres_exporter_user }}:{{ postgres_exporter_password }}@{{ postgres_exporter_pg_host }}:{{ postgres_exporter_pg_port }}/{{ postgres_exporter_pg_dbname }}?sslmode=disable"
+DATA_SOURCE_NAME="user={{ postgres_exporter_user }} password={{ postgres_exporter_password }} host={{ postgres_exporter_pg_host }} port={{ postgres_exporter_pg_port }} dbname={{ postgres_exporter_pg_dbname }} sslmode=disable"
diff --git a/roles/valkey/defaults/main.yml b/roles/valkey/defaults/main.yml
index afba624..6b940c5 100644
--- a/roles/valkey/defaults/main.yml
+++ b/roles/valkey/defaults/main.yml
@@ -42,12 +42,9 @@ valkey_exporter_listen_address: "127.0.0.1:9121"
 valkey_exporter_redis_addr: "redis://127.0.0.1:6379"
 valkey_exporter_user: valkey_exporter
 # valkey_exporter_password: ""  # Intentionally undefined - required when enabled
-# Read-only command set recommended by redis_exporter for monitoring.
-valkey_exporter_commands: >-
-  -@all +@connection +memory -readonly +strlen +config|get +xinfo +pfcount
-  -quit +zcard +type +xlen -readwrite -command +client -wait +scard +llen
-  +hlen +arcount +get +eval +slowlog +cluster|info +cluster|slots +cluster|nodes
-  -hello -echo +info +latency +scan -reset -auth -asking
+# Read-only command set for monitoring: connection (auth/ping/client) + the
+# metrics the exporter scrapes (INFO, CONFIG GET maxmemory).
+valkey_exporter_commands: "-@all +@connection +info +config|get"
 
 # Valkey log level (debug, verbose, notice, warning)
 valkey_loglevel: notice