diff --git a/dankclaw/compose.yaml b/dankclaw/compose.yaml
index 780635b..f92f6fc 100644
--- a/dankclaw/compose.yaml
+++ b/dankclaw/compose.yaml
@@ -26,9 +26,10 @@ services:
       # SearXNG's published port lives on gluetun (network_mode: service:gluetun)
       - "8081:8080"
     healthcheck:
-      # The gluetun image has no curl; its status server answers 200 at /
-      # on port 8000. Use wget (present in the image) against that path.
-      test: ["CMD", "wget", "-qO", "/dev/null", "http://localhost:8000/"]
+      # The gluetun image has no curl, and its :8000 status server 404s on
+      # every path. Check the WireGuard tunnel interface instead: tun0 exists
+      # only while the VPN is connected, so this reflects real tunnel state.
+      test: ["CMD", "sh", "-c", "test -e /sys/class/net/tun0"]
       interval: 60s
       timeout: 10s
       retries: 3