diff --git a/cmd/openolt-adapter/main.go b/cmd/openolt-adapter/main.go
index af8b52b..4b56d02 100644
--- a/cmd/openolt-adapter/main.go
+++ b/cmd/openolt-adapter/main.go
@@ -21,12 +21,14 @@
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
 	"os"
 	"os/signal"
 	"syscall"
 	"time"
 
 	grpc_retry "github.com/grpc-ecosystem/go-grpc-middleware/retry"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	codes "google.golang.org/grpc/codes"
 
 	conf "github.com/opencord/voltha-lib-go/v7/pkg/config"
@@ -538,6 +540,24 @@
 	defer cancel()
 
 	ad := newAdapter(cf)
+	http.Handle("/metrics", promhttp.Handler())
+	go func() {
+		logger.Infof(ctx, "Metrics available at %s/metrics", ad.config.PrometheusAddress)
+		// Create HTTP server with explicit timeouts to prevent slowloris attacks and resource exhaustion.
+		// Using http.ListenAndServe() directly doesn't allow setting timeouts, which is a security risk.
+		// The server uses http.DefaultServeMux (nil handler) which includes the /metrics endpoint registered above.
+		metricsServer := &http.Server{
+			Addr:              ad.config.PrometheusAddress,
+			Handler:           nil,
+			ReadHeaderTimeout: 10 * time.Second,
+			ReadTimeout:       30 * time.Second,
+			WriteTimeout:      30 * time.Second,
+			IdleTimeout:       120 * time.Second,
+		}
+		if err := metricsServer.ListenAndServe(); err != nil {
+			logger.Errorw(ctx, "failed to start metrics HTTP server: ", log.Fields{"error": err})
+		}
+	}()
 
 	p := &probe.Probe{}
 	go p.ListenAndServe(ctx, ad.config.ProbeAddress)