diff --git a/setup/modules/FreeipaAnsible/image/docker-compose.yml b/setup/modules/FreeipaAnsible/image/docker-compose.yml
index 1964440..008e306 100644
--- a/setup/modules/FreeipaAnsible/image/docker-compose.yml
+++ b/setup/modules/FreeipaAnsible/image/docker-compose.yml
@@ -233,11 +233,12 @@ services:
     networks:
       ipa-net:
     healthcheck:
-      # The official Keycloak image ships neither curl nor wget, and since
-      # KC 25 the health endpoints live on the management port (9000) and are
-      # only served when KC_HEALTH_ENABLED=true. Use bash's /dev/tcp instead
-      # of curl so the check works inside the stock image.
-      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '\"status\": \"UP\"' <&3"]
+      # The official Keycloak image ships neither curl nor wget (but has bash),
+      # so probe with bash's /dev/tcp. Check the actual serving port under the
+      # configured relative path (/auth) rather than the 9000 management
+      # /health endpoint — with KC_HTTP_RELATIVE_PATH set, /health/ready on 9000
+      # returns 404, whereas /auth/realms/master reliably returns 200 once up.
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /auth/realms/master HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && head -c 15 <&3 | grep -q '200 OK'"]
       interval: 20s
       timeout: 10s
       retries: 20
@@ -276,7 +277,10 @@ services:
     networks:
       ipa-net:
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost/ >/dev/null 2>&1 || exit 1"]
+      # Use 127.0.0.1, not localhost: inside the container localhost resolves to
+      # IPv6 ::1, but nginx listens on IPv4 0.0.0.0:80 only, so a localhost probe
+      # is refused even though the gateway is serving fine.
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 10