diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 344f9ca..02cadd9 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -115,7 +115,9 @@ jobs:
           PY
           # Fail loudly rather than shipping a config with an unrendered
           # placeholder that would only surface as a runtime parse error.
-          if grep -n '{{' dist/config.toml; then
+          # Matches the placeholder *shape* rather than a bare "{{", so the
+          # template's own prose describing the syntax is not a false positive.
+          if grep -nE '\{\{[A-Z_][A-Z0-9_]*\}\}' dist/config.toml; then
             echo "unrendered placeholder in the config" >&2
             exit 1
           fi
diff --git a/asset/config/config.toml.tmpl b/asset/config/config.toml.tmpl
index f87d067..6689506 100644
--- a/asset/config/config.toml.tmpl
+++ b/asset/config/config.toml.tmpl
@@ -1,8 +1,8 @@
 # rustingface configuration.
 #
-# Rendered from this template by the deploy workflow, substituting {{...}}
-# placeholders from Gitea repo secrets and workflow env. The rendered file is
-# never committed; this template is.
+# Rendered from this template by the deploy workflow, which substitutes the
+# double-brace placeholders below from Gitea repo secrets and workflow env.
+# The rendered file is never committed; this template is.
 #
 # Every key here can be overridden per-key by environment, e.g.
 # RUSTINGFACE__SERVER__LISTEN. Secrets are named by path, never inline.
diff --git a/script/infra-setup.sh b/script/infra-setup.sh
index 6779fd0..76fa59e 100755
--- a/script/infra-setup.sh
+++ b/script/infra-setup.sh
@@ -123,6 +123,10 @@ gitea_ci ALL=(root) NOPASSWD: /usr/bin/firewall-cmd --get-default-zone
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/firewall-cmd --zone=* --query-service=${APP}
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/firewall-cmd --permanent --zone=* --add-service=${APP}
 gitea_ci ALL=(root) NOPASSWD: /usr/bin/firewall-cmd --zone=* --add-service=${APP}
+# The post-deploy health check, run as the service account rather than root:
+# it proves the credentials the service will actually use can reach and write
+# to the bucket, which \`systemctl is-active\` cannot.
+gitea_ci ALL=(${APP}) NOPASSWD: /usr/local/bin/${APP} --config /etc/${APP}/config.toml doctor
 SUDOERS
 chmod 0440 /etc/sudoers.d/.${APP}_gitea_ci.new
 # Verify before moving it into place: a typo in a sudoers file that is already