diff --git a/charts/kube-prometheus-stack.yaml b/charts/kube-prometheus-stack.yaml
index 8f6068ed67..8dc6dd71d2 100644
--- a/charts/kube-prometheus-stack.yaml
+++ b/charts/kube-prometheus-stack.yaml
@@ -19,6 +19,12 @@ customRules:
 
 alertmanager:
   alertmanagerSpec:
+    # Set the externalUrl to the control plane ingress endpoint so alert
+    # notifications and the Alertmanager UI reference a routable address
+    # instead of the in-cluster service URL. The actual endpoint is resolved
+    # at deploy time via the salt helper.
+    externalUrl: '__var__(salt.metalk8s_network.get_control_plane_ingress_endpoint())'
+
     image:
       registry: '__var__(repo.registry_endpoint)'
       repository: '__image_no_reg__(alertmanager)'
diff --git a/salt/metalk8s/addons/prometheus-operator/deployed/chart.sls b/salt/metalk8s/addons/prometheus-operator/deployed/chart.sls
index 9416e86451..e9e0232730 100644
--- a/salt/metalk8s/addons/prometheus-operator/deployed/chart.sls
+++ b/salt/metalk8s/addons/prometheus-operator/deployed/chart.sls
@@ -80316,7 +80316,7 @@ spec:
   alertmanagerConfigNamespaceSelector: {}
   alertmanagerConfigSelector: {}
   automountServiceAccountToken: true
-  externalUrl: http://prometheus-operator-alertmanager.metalk8s-monitoring:9093
+  externalUrl: {% endraw -%}{{ salt.metalk8s_network.get_control_plane_ingress_endpoint() }}{%- raw %}
   hostNetwork: false
   image: {% endraw -%}{{ repo.registry_endpoint }}{%- raw %}/{% endraw -%}{{ build_image_name("alertmanager", False, False) }}{%- raw %}:v0.31.1
   imagePullPolicy: IfNotPresent