diff --git a/deployBotBundle.sh b/deployBotBundle.sh
index f75bca0..9dd0158 100755
--- a/deployBotBundle.sh
+++ b/deployBotBundle.sh
@@ -114,10 +114,24 @@ docker compose up -d discord-bot >/dev/null
 sleep 10
 
 say "result"
+# Wait for the bot to actually serve before calling this a success: a release that crash-loops must fail the
+# deploy (and the CI job), not report 200. BOT_HEALTH_WAIT=0 skips the wait, e.g. if WEB_ENABLED is ever off.
+wait_s="${BOT_HEALTH_WAIT:-45}"
+code=""; waited=0
+while (( waited < wait_s )); do
+  code=$(curl -s -m 3 -o /dev/null -w '%{http_code}' -H 'X-Authentik-Username: deploy-check' \
+           -H 'X-Authentik-Groups: admins' http://127.0.0.1:8000/health || true)
+  [[ $code =~ ^[2-4][0-9][0-9]$ ]] && break
+  sleep 3; waited=$((waited+3))
+done
 docker ps --filter name=discord-bot --format '  {{.Names}} {{.Status}}'
-code=$(curl -s -o /dev/null -w '%{http_code}' -H 'X-Authentik-Username: deploy-check' -H 'X-Authentik-Groups: admins' http://127.0.0.1:8000/health || true)
-echo "  /health -> ${code:-no answer}   (200 = serving; 401/403 = running but the identity headers were refused)"
-docker logs --tail 15 discord-bot 2>&1 | sed 's/^/  /'
+echo "  /health -> ${code:-no answer} after ${waited}s   (200 = serving; 401/403 = serving but it refused the check's headers)"
+docker logs --tail 20 discord-bot 2>&1 | sed 's/^/  /'
 echo
+if [[ ! $code =~ ^[2-4][0-9][0-9]$ ]] && (( wait_s > 0 )); then
+  echo "  FAILED: the bot did not serve on 8000 within ${wait_s}s — the release is installed but not running."
+  echo "  previous release is still here: ./deployBotBundle.sh --rollback"
+  exit 1
+fi
 echo "  web UI: https://${BOT_HOST:-BOT_HOST-not-set}/   (Caddy + Authentik; needs the bot-users group)"
 echo "  rollback: ./deployBotBundle.sh --rollback"