diff --git a/Dockerfile b/Dockerfile
index 72d8a79..1911a43 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -107,8 +107,12 @@ ENV VERIFIER_PORT=3001
 
 EXPOSE 3001
 
+# NOTE: 127.0.0.1 not localhost. Alpine's busybox wget resolves
+# `localhost` to IPv6 (::1) first; the verifier binds IPv4 0.0.0.0,
+# so the IPv6 connection is refused and busybox bails without falling
+# back to IPv4. Using the literal IPv4 address sidesteps the resolver.
 HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
-  CMD wget --no-verbose --tries=1 --spider http://localhost:3001/health || exit 1
+  CMD wget --no-verbose --tries=1 --spider http://127.0.0.1:3001/health || exit 1
 
 CMD ["node", "dist/server.js"]
 
diff --git a/docker-compose.yml b/docker-compose.yml
index f8cdac4..5e13b59 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -50,8 +50,11 @@ services:
       - VERIFIER_CIRCUIT_VERSION=v1
       - LOG_LEVEL=info
     restart: unless-stopped
+    # 127.0.0.1 (not localhost) because alpine busybox wget hits IPv6 first
+    # and the verifier binds 0.0.0.0 (IPv4 only). The Dockerfile carries
+    # the same fix; this is belt-and-braces for compose-level overrides.
     healthcheck:
-      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:3001/health']
+      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://127.0.0.1:3001/health']
       interval: 30s
       timeout: 10s
       retries: 3