diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..0564478
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,10 @@
+# Changelog
+
+## 2026-06-22 — komga healthcheck fix (unattended test campaign)
+- **komga**: healthcheck probe repointed `/api/v1/actuator/health` → `/actuator/health`.
+  - Root cause: komga's Spring Boot actuator endpoint is served unauthenticated at `/actuator/health`
+    (HTTP 200), while everything under the `/api/v1` prefix is auth-gated — so the old probe got
+    HTTP 401, `curl -f` exited 22, and the container reported `unhealthy` despite serving normally
+    on :25600. Diagnosed live on guest 9201 (probe matrix: `/`, `/actuator/health`,
+    `/api/v1/oauth2/providers`, `/login` all 200; `/api/v1/actuator/health` → 401).
+  - The `gotson/komga:1.20.0` image ships `curl` (verified), so the probe tool is unchanged.
diff --git a/templates/komga/docker-compose.yml b/templates/komga/docker-compose.yml
index 316fcff..37f83a3 100644
--- a/templates/komga/docker-compose.yml
+++ b/templates/komga/docker-compose.yml
@@ -35,8 +35,12 @@ services:
       resources:
         limits:
           memory: 512M
+    # HC override: komga's actuator lives at /actuator/health (unauthenticated, 200), NOT under the
+    # auth-gated /api/v1 API prefix — the old /api/v1/actuator/health returns 401 so `curl -f` failed
+    # (exit 22) and the container reported "unhealthy" despite serving fine. The gotson/komga image
+    # ships curl (verified), so curl -f on the unauthenticated endpoint is the correct probe.
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:25600/api/v1/actuator/health"]
+      test: ["CMD", "curl", "-f", "http://localhost:25600/actuator/health"]
       interval: 30s
       timeout: 5s
       retries: 3