diff --git a/deploy/qa/docker-compose.qa.yml b/deploy/qa/docker-compose.qa.yml
index 01b3d24..b14a5ff 100644
--- a/deploy/qa/docker-compose.qa.yml
+++ b/deploy/qa/docker-compose.qa.yml
@@ -36,7 +36,7 @@ services:
       db:
         condition: service_healthy
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/api/v1/health 2>/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/api/v1/health || exit 1"]
       interval: 10s
       timeout: 5s
       retries: 5
diff --git a/src/api/MicCheck.Api/Dockerfile.ci b/src/api/MicCheck.Api/Dockerfile.ci
index 57fc0b5..aa9f36e 100644
--- a/src/api/MicCheck.Api/Dockerfile.ci
+++ b/src/api/MicCheck.Api/Dockerfile.ci
@@ -17,6 +17,11 @@ COPY src/api/MicCheck.Api/ src/api/MicCheck.Api/
 RUN dotnet publish src/api/MicCheck.Api/MicCheck.Api.csproj -c Release -o /out --no-restore
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0
+
+# curl is used by the docker-compose healthcheck; the base image ships neither
+# curl nor wget, so the healthcheck silently fails as "unhealthy" without it.
+RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 COPY --from=build /out .
 EXPOSE 8080