diff --git a/agent/src/collectors/service.rs b/agent/src/collectors/service.rs
index 0ddf46d..1e04e74 100644
--- a/agent/src/collectors/service.rs
+++ b/agent/src/collectors/service.rs
@@ -932,20 +932,24 @@ impl ServiceCollector {
     }
 
     async fn get_vaultwarden_info(&self) -> Option<String> {
-        // Check HTTP connections - vaultwarden typically runs on port 8000 or behind nginx
-        let output = Command::new("/run/current-system/sw/bin/ss")
-            .args(["-tn", "state", "established", "dport", "= :8000"])
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped())
-            .output()
-            .await
-            .ok()?;
+        // Try common vaultwarden ports: 8080, 8084, 8000
+        let ports = ["8080", "8084", "8000"];
+        
+        for port in &ports {
+            let output = Command::new("/run/current-system/sw/bin/ss")
+                .args(["-tn", "state", "established", "dport", &format!("= :{}", port)])
+                .stdout(Stdio::piped())
+                .stderr(Stdio::piped())
+                .output()
+                .await
+                .ok()?;
 
-        if output.status.success() {
-            let stdout = String::from_utf8_lossy(&output.stdout);
-            let connection_count = stdout.lines().count().saturating_sub(1);
-            if connection_count > 0 {
-                return Some(format!("{} connections", connection_count));
+            if output.status.success() {
+                let stdout = String::from_utf8_lossy(&output.stdout);
+                let connection_count = stdout.lines().count().saturating_sub(1);
+                if connection_count > 0 {
+                    return Some(format!("{} connections", connection_count));
+                }
             }
         }