diff --git a/cdn/Dockerfile b/cdn/Dockerfile
index ac93821..ccede73 100644
--- a/cdn/Dockerfile
+++ b/cdn/Dockerfile
@@ -1,4 +1,4 @@
-# outlook-addin-cdn — serves ClickOnce artifacts at platform.dev.marcus-law.co.il/outlook-addin/*
+# outlook-addin-cdn -- serves ClickOnce artifacts at platform.dev.marcus-law.co.il/outlook-addin/*
 #
 # The publish/ directory (produced by the Windows job) is copied into the image
 # along with a custom nginx.conf that maps the ClickOnce-specific MIME types.
@@ -10,6 +10,11 @@ FROM nginx:1.27-alpine
 RUN rm -f /etc/nginx/conf.d/default.conf
 
 COPY nginx.conf /etc/nginx/conf.d/outlook-addin.conf
+
+# Clear the stock nginx html dir so its 50x.html/index.html don't end up
+# alongside our ClickOnce manifests.
+RUN rm -rf /usr/share/nginx/html/*
+
 # Coolify adds a StripPrefix middleware for the /outlook-addin path, so nginx
 # sees requests at the root (/OutlookAddin.vsto, etc) -- copy files to the
 # nginx root accordingly.
@@ -20,5 +25,8 @@ RUN chmod -R a+rX /usr/share/nginx/html
 
 EXPOSE 80
 
+# Use 127.0.0.1 explicitly -- busybox wget resolves "localhost" to ::1 first,
+# but our nginx `listen 80` is IPv4-only, so localhost would refuse the
+# connection and the container would be flagged unhealthy.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD wget -qO- http://localhost/health || exit 1
+    CMD wget -qO- http://127.0.0.1/health || exit 1