diff --git a/dankclaw/anubis/quadlet/anubis.container b/dankclaw/anubis/quadlet/anubis.container
index a105edb..ad5f99b 100644
--- a/dankclaw/anubis/quadlet/anubis.container
+++ b/dankclaw/anubis/quadlet/anubis.container
@@ -42,10 +42,14 @@ Network=dankclaw_default
 Environment=TARGET=http://caddy:8016
 Environment=POLICY_FNAME=/policy/policy.json
 Volume=/home/dank/serverAppConfigs/dankclaw/anubis/policy.json:/policy/policy.json:ro
-# No HealthCmd: the image ships an exec-form HEALTHCHECK
-# (["/app/bin/anubis","--healthcheck"]) and quadlet inherits it when no
-# HealthCmd is set — this dodges the v1 generator's space-splitting quirk
-# that mangled quoted probes for the authentik units.
+# The image ships no HEALTHCHECK (distroless: no shell, binary not at
+# /app/bin), so the probe is declared here: `anubis --healthcheck` exits 0
+# when the challenge server answers on :8923. Exec form — quadlet passes it
+# to podman without a shell, which the distroless image requires.
+HealthCmd=anubis --healthcheck
+HealthInterval=15s
+HealthTimeout=5s
+HealthRetries=3
 
 [Service]
 Restart=always