diff --git a/web/deploy/helm/templates/deployment.yaml b/web/deploy/helm/templates/deployment.yaml
index df3e791..7458c24 100644
--- a/web/deploy/helm/templates/deployment.yaml
+++ b/web/deploy/helm/templates/deployment.yaml
@@ -46,14 +46,14 @@ spec:
               mountPath: /tmp
           livenessProbe:
             httpGet:
-              path: /
+              path: /healthz
               port: http
             initialDelaySeconds: 5
             periodSeconds: 10
             timeoutSeconds: 3
           readinessProbe:
             httpGet:
-              path: /
+              path: /healthz
               port: http
             initialDelaySeconds: 3
             periodSeconds: 10
diff --git a/web/src/hooks.server.ts b/web/src/hooks.server.ts
index 9c26dff..5b0b81f 100644
--- a/web/src/hooks.server.ts
+++ b/web/src/hooks.server.ts
@@ -4,6 +4,11 @@ import { refreshTokens } from '$lib/api/client.server.js';
 import type { ProfileData } from '$lib/api/types.js';
 
 export const handle: Handle = async ({ event, resolve }) => {
+	// Lightweight health endpoint for k8s probes — bypass auth and SSR.
+	if (event.url.pathname === '/healthz') {
+		return new Response('ok', { status: 200 });
+	}
+
 	const accessToken = event.cookies.get('access_token');
 	const sessionToken = event.cookies.get('session_token');