diff --git a/CHANGELOG.md b/CHANGELOG.md
index 929f2868..b668780d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Temporarily skip VRT driver in GDALg to avoid https://github.com/OSGeo/gdal/issues/12645
 - Consistent naming of behavior field
 - Made all python tests comply with mypy strict validation
+- Improved documentation about access to grafana
 
 ## [0.7.13] - 2025-11-04
 
diff --git a/docs/observability.md b/docs/observability.md
index afc7b8a1..c160d7e6 100644
--- a/docs/observability.md
+++ b/docs/observability.md
@@ -34,9 +34,8 @@ helm install eoapi eoapi/eoapi \
   --set monitoring.prometheus.enabled=true \
   --set observability.grafana.enabled=true
 
-# Access Grafana (get password)
-kubectl get secret eoapi-grafana -n eoapi \
-  -o jsonpath="{.data.admin-password}" | base64 -d
+# Access Grafana (see "Accessing Grafana" section below for credentials)
+kubectl port-forward -n eoapi svc/eoapi-obs-grafana 3000:80
 ```
 
 ### Using Configuration Files
@@ -213,6 +212,22 @@ Minimum resource requirements (actual usage varies by cluster size and metrics v
 
 ## Operations
 
+### Accessing Grafana
+
+```bash
+# Get Grafana admin username (usually 'admin')
+kubectl get secret -n eoapi -l app.kubernetes.io/name=grafana \
+  -o jsonpath="{.items[0].data.admin-user}" | base64 --decode
+
+# Get Grafana admin password
+kubectl get secret -n eoapi -l app.kubernetes.io/name=grafana \
+  -o jsonpath="{.items[0].data.admin-password}" | base64 --decode
+
+# Port-forward to access Grafana UI
+kubectl port-forward -n eoapi svc/eoapi-obs-grafana 3000:80
+# Access at http://localhost:3000
+```
+
 ### Verification Commands
 
 ```bash