diff --git a/docker-compose.yaml b/docker-compose.yaml
index 677b9dc..5675d39 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -118,7 +118,7 @@ services:
       auth: { condition: service_healthy }
       storage: { condition: service_healthy }
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:3000/health || exit 1"]
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/health || exit 1"]
       interval: 10s
       timeout: 5s
       retries: 5
diff --git a/services/webmail/Dockerfile b/services/webmail/Dockerfile
index ea4ce0d..4da61b9 100644
--- a/services/webmail/Dockerfile
+++ b/services/webmail/Dockerfile
@@ -11,4 +11,8 @@ COPY --from=build /app/.next/standalone ./
 COPY --from=build /app/.next/static ./.next/static
 COPY --from=build /app/public ./public
 EXPOSE 3000
+# Docker sets HOSTNAME to the container ID by default; Next's standalone
+# server.js honors that env var and binds only to it, refusing localhost
+# (and thus the healthcheck). Force it to listen on every interface.
+ENV HOSTNAME=0.0.0.0
 CMD ["node", "server.js"]