diff --git a/hub/cmd/hub/main.go b/hub/cmd/hub/main.go
index b2652ca..b312872 100644
--- a/hub/cmd/hub/main.go
+++ b/hub/cmd/hub/main.go
@@ -85,6 +85,12 @@ func main() {
 	// Build HTTP mux
 	mux := http.NewServeMux()
 
+	// Health check endpoint — bypasses auth (for k8s probes)
+	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("ok"))
+	})
+
 	// API routes (no dashboard auth for report ingest)
 	mux.Handle("/api/v1/", apiHandler)