diff --git a/dankclaw/authentik/quadlet/authentik-postgres.container b/dankclaw/authentik/quadlet/authentik-postgres.container
index 800f86b..cc5389e 100644
--- a/dankclaw/authentik/quadlet/authentik-postgres.container
+++ b/dankclaw/authentik/quadlet/authentik-postgres.container
@@ -21,7 +21,12 @@ Environment=POSTGRES_DB=authentik
 Environment=POSTGRES_USER=authentik
 Environment=POSTGRES_PASSWORD=${AUTHENTIK_PG_PASS}
 Volume=/home/dank/authentik/postgres:/var/lib/postgresql/data
-HealthCmd=/bin/sh -c "pg_isready -d authentik -U authentik"
+# Unquoted argv: this quadlet generator space-splits HealthCmd into the
+# healthcheck's argv array, so a quoted probe would arrive mangled (the old
+# `/bin/sh -c "pg_isready..."` form arrived as /bin/sh + broken args and
+# failed with exit 1 forever — the health status was a false negative while
+# the DB itself accepted connections). Bare argv works under both exec forms.
+HealthCmd=pg_isready -d authentik -U authentik
 HealthInterval=30s
 HealthTimeout=10s
 HealthRetries=5