diff --git a/managed/services/grafana/auth_server.go b/managed/services/grafana/auth_server.go
index 0eb6842244..2594bb678e 100644
--- a/managed/services/grafana/auth_server.go
+++ b/managed/services/grafana/auth_server.go
@@ -531,6 +531,8 @@ func cleanPath(p string) (string, error) {
 
 	cleanedPath := path.Clean(unescaped)
 
+	cleanedPath = strings.ReplaceAll(cleanedPath, "\n", " ")
+
 	u, err := url.Parse(cleanedPath)
 	if err != nil {
 		return "", err
diff --git a/managed/services/grafana/auth_server_test.go b/managed/services/grafana/auth_server_test.go
index 4fb26b249d..4828c3e1e4 100644
--- a/managed/services/grafana/auth_server_test.go
+++ b/managed/services/grafana/auth_server_test.go
@@ -422,6 +422,9 @@ func Test_cleanPath(t *testing.T) {
 		}, {
 			"/v1/AWSInstanceCheck/..%2f..%2f/logs.zip",
 			"/logs.zip",
+		}, {
+			"/graph/api/datasources/proxy/8/?query=WITH%20(%0A%20%20%20%20CASE%20%0A%20%20%20%20%20%20%20%20WHEN%20(3000%20%25%2060)%20%3D%200%20THEN%203000%0A%20%20%20%20ELSE%2060%20END%0A)%20AS%20scale%0ASELECT%0A%20%20%20%20(intDiv(toUInt32(timestamp)%2C%203000)%20*%203000)%20*%201000%20as%20t%2C%0A%20%20%20%20hostname%20h%2C%0A%20%20%20%20status%20s%2C%0A%20%20%20%20SUM(req_count)%20as%20req_count%0AFROM%20pinba.report_by_all%0AWHERE%0A%20%20%20%20timestamp%20%3E%3D%20toDateTime(1707139680)%20AND%20timestamp%20%3C%3D%20toDateTime(1707312480)%0A%20%20%20%20AND%20status%20%3E%3D%20400%0A%20%20%20%20AND%20CASE%20WHEN%20%27all%27%20%3C%3E%20%27all%27%20THEN%20schema%20%3D%20%27all%27%20ELSE%201%20END%0A%20%20%20%20AND%20CASE%20WHEN%20%27all%27%20%3C%3E%20%27all%27%20THEN%20hostname%20%3D%20%27all%27%20ELSE%201%20END%0A%20%20%20%20AND%20CASE%20WHEN%20%27all%27%20%3C%3E%20%27all%27%20THEN%20server_name%20%3D%20%27all%27%20ELSE%201%20END%0AGROUP%20BY%20t%2C%20h%2C%20s%0AORDER%20BY%20t%20FORMAT%20JSON",
+			"/graph/api/datasources/proxy/8/",
 		},
 	}
 	for _, tt := range tests {
diff --git a/update/ansible/playbook/tasks/update.yml b/update/ansible/playbook/tasks/update.yml
index a4ebee9290..ff6632a6ad 100644
--- a/update/ansible/playbook/tasks/update.yml
+++ b/update/ansible/playbook/tasks/update.yml
@@ -126,6 +126,13 @@
         path: /etc/supervisord.d/supervisord.ini
       when: not is_docker
 
+    - name: Stop systemd pmm-agent service, if running
+      systemd:
+        name: pmm-agent
+        state: stopped
+        enabled: no
+      when: not is_docker
+
     - name: Create grafana config
       include_role:
         name: grafana
@@ -304,15 +311,6 @@
       include_role:
         name: clickhouse
 
-    # Fix things that should be fixed before restarts.
-
-    - name: Stop systemd pmm-agent service, if running
-      systemd:
-        name: pmm-agent
-        state: stopped
-        enabled: no
-      when: not is_docker
-
     # https://jira.percona.com/browse/PMM-9298
     - name: Copy rezise-xfs file for lvm
       copy: