diff --git a/nixos/modules/monitoring/server/grafana.nix b/nixos/modules/monitoring/server/grafana.nix
index 5986ba0b7ce6a30a8a81ff416d89a2b054b3436c..5b1b4d861ef6795bfd71fa475b461866817447c4 100644
--- a/nixos/modules/monitoring/server/grafana.nix
+++ b/nixos/modules/monitoring/server/grafana.nix
@@ -70,6 +70,12 @@ in {
 
       # No phoning home
       analytics.reporting.enable = false;
+
+      # Force Grafana to believe it is reachable via https on the default port
+      # number because that's where the nginx that forwards traffic to it is
+      # listening.  Grafana's own server listens on an internal address that
+      # doesn't matter to anyone except our nginx instance.
+      rootUrl = "https://%(domain)s/";
     };
 
     services.grafana.auth = {