diff --git a/script/infra-setup.sh b/script/infra-setup.sh
index 643a179..8759147 100755
--- a/script/infra-setup.sh
+++ b/script/infra-setup.sh
@@ -295,7 +295,7 @@ $EDGE_HOST is configured. One step is NOT automated here:
            --hostname blackbeard --domain internal --rr A --server <edge mesh ip>
        done
 
-     `create` only saves; POST /api/unbound/service/reconfigure on each router
+     \`create\` only saves; POST /api/unbound/service/reconfigure on each router
      to apply.
 
 EOF
@@ -441,8 +441,27 @@ REMOTE
 
     info "verifying the mapping from $API_HOST"
     if reachable "$API_HOST"; then
-        ssh "$API_HOST" "sudo -u blackbeard psql 'host=$PG_PRIMARY port=5432 dbname=$DB_NAME user=$DB_ROLE sslmode=verify-full sslrootcert=/etc/pki/ca-trust/source/anchors/root-internal.pem sslcert=/etc/pki/tls/misc/\$(hostname -f).pem sslkey=/etc/pki/tls/private/\$(hostname -f).pem' -tAc 'select current_user'" \
-            || warn "the app host could not authenticate to $PG_PRIMARY — check the CN mapping and the key ACL"
+        # `psql` is not installed on an app host and there is no reason for it
+        # to be, so its absence must not be reported as an authentication
+        # failure — that reads as a broken mapping and sends you looking in the
+        # wrong place. When it is missing, the deploy's own health probe is the
+        # verification: the daemon connects with exactly these credentials.
+        if ssh "$API_HOST" "command -v psql >/dev/null"; then
+            ssh "$API_HOST" "sudo -u blackbeard psql 'host=$PG_PRIMARY port=5432 dbname=$DB_NAME user=$DB_ROLE sslmode=verify-full sslrootcert=/etc/pki/ca-trust/source/anchors/root-internal.pem sslcert=/etc/pki/tls/misc/\$(hostname -f).pem sslkey=/etc/pki/tls/private/\$(hostname -f).pem' -tAc 'select current_user'" \
+                || warn "the app host could not authenticate to $PG_PRIMARY — check the CN mapping and the key ACL"
+        else
+            info "psql absent on $API_HOST; the deploy's health probe verifies the connection instead"
+        fi
+    fi
+
+    # Not a warning to be dismissed. pg_ident.conf contents are NOT replicated,
+    # so a standby that never received this mapping will refuse the app the
+    # moment it is promoted — with an authentication error that looks like a
+    # certificate problem and arrives during an outage.
+    if ! ssh -o ConnectTimeout=8 -o BatchMode=yes "$PG_STANDBY" true 2>/dev/null; then
+        warn "$PG_STANDBY did not receive the pg_ident mapping."
+        warn "Re-run: ./script/infra-setup.sh --role database   once it is reachable."
+        warn "Until then a failover to it will lock blackbeard-api out of the database."
     fi
 }