diff --git a/metropolis/test/e2e/main_test.go b/metropolis/test/e2e/main_test.go
index 4a54d2f..1e51332 100644
--- a/metropolis/test/e2e/main_test.go
+++ b/metropolis/test/e2e/main_test.go
@@ -18,6 +18,8 @@
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
 	"io"
@@ -25,6 +27,7 @@
 	"net/http"
 	_ "net/http"
 	_ "net/http/pprof"
+	"net/url"
 	"os"
 	"strings"
 	"testing"
@@ -357,6 +360,44 @@
 				}
 				return fmt.Errorf("job still running")
 			})
+			util.TestEventual(t, "Prometheus node metrics retrieved", ctx, smallTestTimeout, func(ctx context.Context) error {
+				pool := x509.NewCertPool()
+				pool.AddCert(cluster.CACertificate)
+				cl := http.Client{
+					Transport: &http.Transport{
+						TLSClientConfig: &tls.Config{
+							Certificates: []tls.Certificate{cluster.Owner},
+							RootCAs:      pool,
+						},
+						DialContext: func(ctx context.Context, _, addr string) (net.Conn, error) {
+							return cluster.DialNode(ctx, addr)
+						},
+					},
+				}
+				u := url.URL{
+					Scheme: "https",
+					Host:   net.JoinHostPort(cluster.NodeIDs[0], common.MetricsPort.PortString()),
+					Path:   "/metrics/node",
+				}
+				res, err := cl.Get(u.String())
+				if err != nil {
+					return err
+				}
+				defer res.Body.Close()
+				if res.StatusCode != 200 {
+					return fmt.Errorf("status code %d", res.StatusCode)
+				}
+
+				body, err := io.ReadAll(res.Body)
+				if err != nil {
+					return err
+				}
+				needle := "node_uname_info"
+				if !strings.Contains(string(body), needle) {
+					return util.Permanent(fmt.Errorf("could not find %q in returned response", needle))
+				}
+				return nil
+			})
 			if os.Getenv("HAVE_NESTED_KVM") != "" {
 				util.TestEventual(t, "Pod for KVM/QEMU smoke test", ctx, smallTestTimeout, func(ctx context.Context) error {
 					runcRuntimeClass := "runc"
diff --git a/metropolis/test/launch/cluster/cluster.go b/metropolis/test/launch/cluster/cluster.go
index 0efd08b..615a9cc 100644
--- a/metropolis/test/launch/cluster/cluster.go
+++ b/metropolis/test/launch/cluster/cluster.go
@@ -10,6 +10,7 @@
 	"crypto/ed25519"
 	"crypto/rand"
 	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
 	"io"
@@ -504,6 +505,9 @@
 	// creation.
 	NodeIDs []string
 
+	// CACertificate is the cluster's CA certificate.
+	CACertificate *x509.Certificate
+
 	// nodesDone is a list of channels populated with the return codes from all the
 	// nodes' qemu instances. It's used by Close to ensure all nodes have
 	// successfully been stopped.
@@ -829,6 +833,12 @@
 		ctxC()
 		return nil, fmt.Errorf("GetClusterInfo: %w", err)
 	}
+	caCert, err := x509.ParseCertificate(resI.CaCertificate)
+	if err != nil {
+		ctxC()
+		return nil, fmt.Errorf("ParseCertificate: %w", err)
+	}
+	cluster.CACertificate = caCert
 
 	// Use the retrieved information to configure the rest of the node options.
 	for i := 1; i < opts.NumNodes; i++ {