diff --git a/CHANGELOG.md b/CHANGELOG.md
index db3b2b79..f409ddcf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,18 @@ The published image tags: `latest` follows the most recent release below,
 
 ## Unreleased
 
+### Fixed
+
+- **The Mercure hub reported itself unhealthy for ever while working perfectly.** Its readiness
+  probe moved: `/healthz` answers 404 now, `curl -f` reads that as a failure, and the container
+  never goes green again. On a normal install nothing waits on that, so live updates carried on
+  and the only symptom was `(unhealthy)` in `docker ps` and in the TrueNAS view — alarming, and
+  about nothing. The test stack does wait on it, so CI stopped being able to start at all.
+
+  The check now asks the hub where the hub actually answers, which is the path its own built-in
+  healthcheck has always used. Overriding that with a URL of our own is what let the two drift
+  apart in the first place.
+
 ## v0.2.29 — 2026-09-21
 
 ### Fixed
diff --git a/compose.test.yaml b/compose.test.yaml
index a9cea7e5..cd72f8e8 100644
--- a/compose.test.yaml
+++ b/compose.test.yaml
@@ -188,7 +188,13 @@ services:
       MERCURE_PUBLISHER_JWT_KEY: e2e-mercure-secret-not-for-production
       MERCURE_SUBSCRIBER_JWT_KEY: e2e-mercure-secret-not-for-production
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost/healthz"]
+      # The ADMIN endpoint, not "/healthz" on the hub port, and not a URL of
+      # our own choosing. The hub moved its readiness probe: "/healthz" now
+      # answers 404, `curl -f` treats that as failure, and the container is
+      # marked unhealthy for ever while serving perfectly. The image's own
+      # HEALTHCHECK has always used this path — overriding it with a guess is
+      # what let the two drift apart, and the guess is the half that rotted.
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:2019/mercure/health/ready"]
       interval: 5s
       timeout: 5s
       retries: 10
diff --git a/compose.yaml b/compose.yaml
index 2c5c57fc..6b85d3d4 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -300,7 +300,13 @@ services:
       secrets-init:
         condition: service_completed_successfully
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost/healthz"]
+      # The ADMIN endpoint, not "/healthz" on the hub port, and not a URL of
+      # our own choosing. The hub moved its readiness probe: "/healthz" now
+      # answers 404, `curl -f` treats that as failure, and the container is
+      # marked unhealthy for ever while serving perfectly. The image's own
+      # HEALTHCHECK has always used this path — overriding it with a guess is
+      # what let the two drift apart, and the guess is the half that rotted.
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:2019/mercure/health/ready"]
       timeout: 5s
       retries: 5
       start_period: 60s