diff --git a/playbooks/prod_web.yml b/playbooks/prod_web.yml
index 5b765d3..3394324 100755
--- a/playbooks/prod_web.yml
+++ b/playbooks/prod_web.yml
@@ -170,8 +170,6 @@
             command: check_by_ssh!/usr/lib/nagios/plugins/check_load -r -w 5,4,3 -c 7,6,5
           - name: CPU Utilization
             command: check_by_ssh!/usr/local/bin/monitoring-scripts/check_cpu_stats -w 75 -c 90
-          - name: Disk Usage
-            command: check_by_ssh!/usr/lib/nagios/plugins/check_disk -M -u GB -X nfs -X tracefs -X cgroup -X tmpfs -X overlay -X shm -w 15% -c 10% -W 15% -K 10% -A -I '^/run/' -I '^udev$' -I '^/var/lib/kubelet/'
           - name: DNS Resolution
             command: check_by_ssh!/usr/lib/nagios/plugins/check_etc_resolv
           - name: Last Ansible Play
@@ -209,6 +207,11 @@
             hostgroup: "!role-hypervisor"
           - name: Users
             command: check_by_ssh!/usr/lib/nagios/plugins/check_users -w 3 -c 5
+            # Privileged checks
+            # Required because check_disk may attempt to get the free space of
+            # restricted mountpoints
+          - name: Disk Usage
+            command: check_by_ssh!/usr/bin/sudo /usr/lib/nagios/plugins/check_disk -M -u GB -X nfs -X tracefs -X cgroup -X tmpfs -X overlay -X shm -w 15% -c 10% -W 15% -K 10% -A -I '^/run/' -I '^udev$' -I '^/var/lib/kubelet/' -I'^/tmp/.mount_'
           # Device role checks
           # hypervisor (which is assumed to be Proxmox)
           - name: PVE Unit pve-firewall.service