diff --git a/Dockerfile b/Dockerfile
index 8426b7c..6bde712 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,5 +12,6 @@ ENV PATH="/opt/media/bin:${PATH}"
 ENV HOST=0.0.0.0 PORT=3000 FLUX_DATA_DIR=/app/data YTDLP_PATH=/opt/media/bin/yt-dlp FFMPEG_PATH=/usr/bin/ffmpeg
 USER node
 EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD ["node", "-e", "const headers = {}; if (process.env.FLUX_ACCESS_PASSWORD) headers.authorization = 'Basic ' + Buffer.from((process.env.FLUX_ACCESS_USERNAME || 'flux') + ':' + process.env.FLUX_ACCESS_PASSWORD).toString('base64'); fetch('http://127.0.0.1:3000/api/health', { headers }).then((response) => response.json().then((body) => process.exit(response.ok && body.ready ? 0 : 1))).catch(() => process.exit(1))"]
 VOLUME ["/app/data"]
 CMD ["node", "server.mjs"]
diff --git a/README.md b/README.md
index 886a8ec..a5ffb5e 100644
--- a/README.md
+++ b/README.md
@@ -282,6 +282,7 @@ docker compose up -d --build
 2. Caddy obtains and renews TLS certificates automatically.
 3. Register `https://YOUR_DOMAIN/auth/google/callback` in Google Cloud.
 4. The **PO-token provider** (`flux-pot`) stays on the internal Docker network. **Never publish its port.**
+5. The Flux container includes a Docker healthcheck for `/api/health`; use `docker compose ps` to verify that it becomes `healthy` after startup.
 
 > **Operator notes.** YouTube may still block datacentre IPs or require extra checks, and a token provider is no guarantee. Keep yt-dlp and FFmpeg updated (rebuild the image regularly), apply container filesystem quotas, and add outbound firewall rules as defence in depth. The optional cookies file is sensitive and must never be served. The shared Basic-auth password is only an outer gate and does **not** grant full-download privileges.