diff --git a/.github/workflows/cd-apps.yml b/.github/workflows/cd-apps.yml
index 24ab70f..fb709f0 100644
--- a/.github/workflows/cd-apps.yml
+++ b/.github/workflows/cd-apps.yml
@@ -105,7 +105,9 @@ jobs:
             # Pull and deploy app containers
             docker compose --env-file app.env pull journal planner
             docker compose --env-file app.env run --rm journal npx drizzle-kit push --config /app/packages/db/drizzle.config.ts --force
-            docker compose --env-file app.env up -d journal planner
+            # --remove-orphans cleans up containers whose service was deleted
+            # from the compose file, matching cd-infra's behaviour.
+            docker compose --env-file app.env up -d --remove-orphans journal planner
 
             # Clean up
             docker image prune -af
diff --git a/.github/workflows/cd-infra.yml b/.github/workflows/cd-infra.yml
index b1839c4..e76dcf3 100644
--- a/.github/workflows/cd-infra.yml
+++ b/.github/workflows/cd-infra.yml
@@ -79,8 +79,11 @@ jobs:
             if [ "${{ github.event.inputs.restart_all }}" = "true" ]; then
               docker compose --env-file .env up -d --remove-orphans
             else
-              # Restart infra services (except Caddy — just reload its config)
-              docker compose --env-file .env up -d postgres prometheus loki promtail grafana postgres-exporter node-exporter cadvisor
+              # Restart infra services (except Caddy — just reload its config).
+              # --remove-orphans cleans up containers whose service was deleted
+              # from the compose file (e.g., the flagship `brouter` removal in
+              # PR #297 left an orphan that had to be removed by hand).
+              docker compose --env-file .env up -d --remove-orphans postgres prometheus loki promtail grafana postgres-exporter node-exporter cadvisor
               docker compose exec caddy caddy reload --config /etc/caddy/Caddyfile
             fi
 
diff --git a/apps/journal/Dockerfile b/apps/journal/Dockerfile
index d9f8e31..9b1d751 100644
--- a/apps/journal/Dockerfile
+++ b/apps/journal/Dockerfile
@@ -1,5 +1,7 @@
 FROM node:25-slim AS base
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+# curl is used by the docker-compose healthcheck (node:25-slim is Debian
+# trixie-slim and ships neither curl nor wget by default).
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
 RUN npm install -g pnpm@10.6.5
 WORKDIR /app
 
diff --git a/apps/planner/Dockerfile b/apps/planner/Dockerfile
index 6693d8c..6bb5daf 100644
--- a/apps/planner/Dockerfile
+++ b/apps/planner/Dockerfile
@@ -1,5 +1,7 @@
 FROM node:25-slim AS base
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+# curl is used by the docker-compose healthcheck (node:25-slim is Debian
+# trixie-slim and ships neither curl nor wget by default).
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
 RUN npm install -g pnpm@10.6.5
 WORKDIR /app