diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index cc35201..58e7ac0 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -256,7 +256,15 @@ jobs:
         run: |
           set -euo pipefail
           for attempt in $(seq 1 30); do
-            if ssh "$API_HOST" "curl -sf http://127.0.0.1:$API_PORT/v1/healthz" > health.json; then
+            # NOT 127.0.0.1. The API binds the host's *mesh* address, never
+            # loopback and never 0.0.0.0 — the fleet has one firewalld default
+            # zone, so a wildcard bind plus the named service would publish it
+            # on every address the host carries, and the edge proxy is at
+            # another site so loopback-only would not serve it at all. Probing
+            # loopback therefore gets connection-refused against a perfectly
+            # healthy daemon. `hostname -f` resolves to the mesh address, so
+            # this needs no value carried between steps.
+            if ssh "$API_HOST" "curl -sf http://\$(hostname -f):$API_PORT/v1/healthz" > health.json; then
               cat health.json
               # `healthy` covers the database. Chain reachability is
               # deliberately not part of it: a chain configured before it