diff --git a/ansible/roles/menu-app/tasks/main.yaml b/ansible/roles/menu-app/tasks/main.yaml
index 3399fcf..ad8dd42 100644
--- a/ansible/roles/menu-app/tasks/main.yaml
+++ b/ansible/roles/menu-app/tasks/main.yaml
@@ -42,6 +42,24 @@
     state: started
     restart_policy: unless-stopped
     user: '{{ app_uid }}:{{ app_gid }}'
+    # Force a rebuild of the container with -e recreate_container=true: that is
+    # what applies a changed healthcheck or env to an existing container, since
+    # the module otherwise leaves a running one alone.
+    recreate: '{{ recreate_container | default(false) | bool }}'
+    # Declared here rather than relied on from the image: podman builds an OCI
+    # image by default and drops Docker's HEALTHCHECK instruction, so the
+    # Dockerfile's own healthcheck never reaches the container. node is in the
+    # image and the exec form needs no shell quoting.
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - "fetch('http://127.0.0.1:3000/healthz').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      start_period: 30s
+      retries: 3
     env:
       MENU_ROOT: /data
       MENU_SITE_CONFIG: '/app/config/{{ site }}.site.json'