diff --git a/CHANGELOG.md b/CHANGELOG.md
index 549924d..e2919a7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,29 @@
+## Three health probes now dial where the app actually listens (2026-09-22, R-618)
+
+**Templates only, and no `image:` line moved — so no `catalog_since` moves either.**
+
+`.felhom.yml`'s `healthcheck.checks` tells the controller where to knock, and it knocks from INSIDE
+the compose network: `<container-name>:<port><path>`. The port is therefore the port the process
+listens on inside its container — never the published port and never Traefik's. Three templates
+named something else:
+
+| app | was | is | what the app's own compose healthcheck dials |
+|---|---|---|---|
+| tandoor | port `8080` | port `80` | `http://127.0.0.1:80/accounts/login/` |
+| zipline | path `/api/health` | path `/api/healthcheck` | `http://127.0.0.1:3000/api/healthcheck` |
+| wger | port `80` | port `8000` | `http://127.0.0.1:8000` |
+
+**Why this is not merely a wrong badge.** The guarded update's `verifying` phase waits on this same
+probe, and `failAndHold` runs `compose down` when it never goes green. So a SUCCESSFUL update ended
+by STOPPING a working app. Measured on guest 9202, 2026-09-21: tandoor served HTTP 200 on the new
+version at four samples across five minutes, docker's own healthcheck green throughout, and the
+controller stopped it at +361.9 s.
+
+Proven live on guest 9202 before and after, through the product: at the live pin all three read
+`Nem egeszseges` / `Not healthy` on their own app page while their front doors served a real page
+(tandoor 200 `Login / Sign In`, zipline 200 `Zipline`, wger 200 `wger Workout Manager`) and docker
+reported every container healthy.
+
 ## Vikunja fixture: the create verb is PUT, not POST (2026-09-21, R-462)
 
 Test code only, and a one-line correction to the fixture shipped earlier the same night.
diff --git a/templates/tandoor/.felhom.yml b/templates/tandoor/.felhom.yml
index c1ff497..8f94cf7 100644
--- a/templates/tandoor/.felhom.yml
+++ b/templates/tandoor/.felhom.yml
@@ -71,7 +71,10 @@ app_info:
 healthcheck:
   checks:
     - type: http
-      port: 8080
+      # 80, not 8080: the probe dials the container from INSIDE the compose
+      # network, so this is the port the process LISTENS on. tandoor's own compose healthcheck
+      # dials 127.0.0.1:80 (R-618).
+      port: 80
       path: "/accounts/login/"
 
 # --- English copy (localisation slice 5, R-560) --------------------------------------------
diff --git a/templates/wger/.felhom.yml b/templates/wger/.felhom.yml
index 6a4e505..2016da3 100644
--- a/templates/wger/.felhom.yml
+++ b/templates/wger/.felhom.yml
@@ -66,7 +66,9 @@ app_info:
 healthcheck:
   checks:
     - type: http
-      port: 80
+      # 8000, not 80: gunicorn listens on 8000 inside the container; 80 is only
+      # what traefik publishes. wger's own compose healthcheck dials 127.0.0.1:8000 (R-618).
+      port: 8000
 
 # --- English copy (localisation slice 5, R-560) --------------------------------------------
 # The Hungarian above is UNCHANGED. A box on English reads this block field by field; a missing
diff --git a/templates/zipline/.felhom.yml b/templates/zipline/.felhom.yml
index 883e2ea..cb8c1a4 100644
--- a/templates/zipline/.felhom.yml
+++ b/templates/zipline/.felhom.yml
@@ -75,7 +75,10 @@ healthcheck:
   checks:
     - type: api
       port: 3000
-      path: "/api/health"
+      # /api/healthcheck, not /api/health: this probe is `api` WITH an expect
+      # block, so a 404 on the wrong path reads as unhealthy. zipline's own compose healthcheck
+      # dials /api/healthcheck (R-618).
+      path: "/api/healthcheck"
       expect:
         status: 200