diff --git a/.gitea/workflows/deploy-nalu.yml b/.gitea/workflows/deploy-nalu.yml
index ee0c35e..86f53bb 100644
--- a/.gitea/workflows/deploy-nalu.yml
+++ b/.gitea/workflows/deploy-nalu.yml
@@ -250,10 +250,25 @@ jobs:
         SSHEOF
 
     - name: Health check
+      env:
+        SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
       run: |
-        sleep 35
-        ssh -o StrictHostKeyChecking=no ubuntu@${{ env.SWARM_MANAGER }} \
-          'curl -sf http://localhost:8084/health && echo "✅ nalu healthy" || (echo "❌ health check failed"; docker service ps nalu_app; exit 1)'
+        mkdir -p ~/.ssh
+        echo "${SSH_PRIVATE_KEY}" | base64 -d > ~/.ssh/id_rsa
+        chmod 600 ~/.ssh/id_rsa
+        ssh-keyscan -H ${{ env.SWARM_MANAGER }} >> ~/.ssh/known_hosts 2>/dev/null
+        # retry for up to 2 minutes
+        for i in $(seq 1 12); do
+          sleep 10
+          echo "Attempt $i/12..."
+          if ssh -o StrictHostKeyChecking=no ubuntu@${{ env.SWARM_MANAGER }} 'curl -sf http://localhost:8084/health'; then
+            echo "✅ nalu healthy"
+            exit 0
+          fi
+        done
+        echo "❌ health check failed after 2 minutes"
+        ssh -o StrictHostKeyChecking=no ubuntu@${{ env.SWARM_MANAGER }} 'docker service ps nalu_app'
+        exit 1
 
   # ─── Cleanup ──────────────────────────────────────────────────────────────
   cleanup: