diff --git a/hscontrol/app.go b/hscontrol/app.go
index 18d4a1b423..acc942293c 100644
--- a/hscontrol/app.go
+++ b/hscontrol/app.go
@@ -452,7 +452,7 @@ func (h *Headscale) ensureUnixSocketIsAbsent() error {
 
 func (h *Headscale) createRouter(grpcMux *grpcRuntime.ServeMux) *mux.Router {
 	router := mux.NewRouter()
-	// router.Use(prometheusMiddleware)
+	router.Use(prometheusMiddleware)
 	router.PathPrefix("/debug/pprof/").Handler(http.DefaultServeMux)
 
 	router.HandleFunc(ts2021UpgradePath, h.NoiseUpgradeHandler).Methods(http.MethodPost)
diff --git a/hscontrol/metrics.go b/hscontrol/metrics.go
index c00b8e4485..9d802caf79 100644
--- a/hscontrol/metrics.go
+++ b/hscontrol/metrics.go
@@ -68,8 +68,9 @@ func prometheusMiddleware(next http.Handler) http.Handler {
 
 		// Ignore streaming and noise sessions
 		// it has its own router further down.
-		if path == "/ts2021" || path == "/machine/map" {
+		if path == "/ts2021" || path == "/machine/map" || path == "/derp" || path == "/derp/probe" || path == "/bootstrap-dns" {
 			next.ServeHTTP(w, r)
+			return
 		}
 
 		rw := &respWriterProm{ResponseWriter: w}
diff --git a/hscontrol/noise.go b/hscontrol/noise.go
index 5c84dd04cf..9ddf2c859e 100644
--- a/hscontrol/noise.go
+++ b/hscontrol/noise.go
@@ -95,7 +95,7 @@ func (h *Headscale) NoiseUpgradeHandler(
 	// The HTTP2 server that exposes this router is created for
 	// a single hijacked connection from /ts2021, using netutil.NewOneConnListener
 	router := mux.NewRouter()
-	// router.Use(prometheusMiddleware)
+	router.Use(prometheusMiddleware)
 
 	router.HandleFunc("/machine/register", noiseServer.NoiseRegistrationHandler).
 		Methods(http.MethodPost)