diff --git a/.github/workflows/cd-brouter.yml b/.github/workflows/cd-brouter.yml
index 0a49eea..f8a7b1d 100644
--- a/.github/workflows/cd-brouter.yml
+++ b/.github/workflows/cd-brouter.yml
@@ -45,6 +45,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Decrypt shared secret
+        id: decrypt
         run: |
           curl -sLO https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64
           chmod +x sops-v3.9.4.linux.amd64
@@ -55,6 +56,14 @@ jobs:
             | grep '^BROUTER_AUTH_TOKEN=' > infrastructure/brouter-host/.env
           chmod 0600 infrastructure/brouter-host/.env
 
+          # GHCR pull credential — not shipped to the host's filesystem;
+          # passed to the SSH step as an env var so it only lives in
+          # memory during `docker login`.
+          GHCR_TOKEN=$(SOPS_AGE_KEY="${{ secrets.AGE_SECRET_KEY }}" ./sops-v3.9.4.linux.amd64 -d infrastructure/secrets.app.env \
+            | grep '^DEPLOY_GHCR_TOKEN=' | cut -d= -f2-)
+          echo "::add-mask::$GHCR_TOKEN"
+          echo "GHCR_TOKEN=$GHCR_TOKEN" >> $GITHUB_ENV
+
       - name: Copy compose project to dedicated host
         uses: appleboy/scp-action@v1
         with:
@@ -73,6 +82,7 @@ jobs:
           username: trails
           port: ${{ secrets.BROUTER_DEPLOY_SSH_PORT }}
           key: ${{ secrets.BROUTER_DEPLOY_SSH_KEY }}
+          envs: GHCR_TOKEN
           script: |
             set -euo pipefail
             cd /home/trails/brouter
@@ -89,6 +99,11 @@ jobs:
               mkdir -p segments
             fi
 
+            # GHCR images (brouter) are private; log in so pull works.
+            # Credentials stay in ~/.docker/config.json; acceptable on a
+            # single-tenant trails user.
+            echo "$GHCR_TOKEN" | docker login ghcr.io -u stigi --password-stdin
+
             docker compose pull
             docker compose up -d --remove-orphans
             docker compose ps
diff --git a/docker/brouter/Dockerfile b/docker/brouter/Dockerfile
index 467b636..477c1ab 100644
--- a/docker/brouter/Dockerfile
+++ b/docker/brouter/Dockerfile
@@ -3,7 +3,7 @@ FROM eclipse-temurin:11-jre-jammy
 WORKDIR /brouter
 
 # Download latest BRouter release
-ARG BROUTER_VERSION=1.7.8
+ARG BROUTER_VERSION=1.7.9
 RUN apt-get update && apt-get install -y --no-install-recommends wget unzip curl \
     && wget -q "https://github.com/abrensch/brouter/releases/download/v${BROUTER_VERSION}/brouter-${BROUTER_VERSION}.zip" \
     && unzip "brouter-${BROUTER_VERSION}.zip" \
diff --git a/infrastructure/brouter-host/docker-compose.yml b/infrastructure/brouter-host/docker-compose.yml
index 248eb5c..429bbbf 100644
--- a/infrastructure/brouter-host/docker-compose.yml
+++ b/infrastructure/brouter-host/docker-compose.yml
@@ -33,12 +33,10 @@ services:
         max-file: "3"
     labels:
       trails.cool.service: "brouter"
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q -O- http://localhost:17777/ >/dev/null 2>&1 || exit 1"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 60s
+    # No custom healthcheck: the BRouter image strips wget/curl post-build,
+    # and /bin/sh in the base image doesn't support /dev/tcp. Real health
+    # is observed via Caddy upstream (502 on outage) and the Planner-side
+    # brouter_request_duration_seconds metric.
 
   caddy:
     image: caddy:2-alpine
@@ -46,7 +44,7 @@ services:
     restart: unless-stopped
     depends_on:
       brouter:
-        condition: service_healthy
+        condition: service_started
     # Bind ONLY to the vSwitch IP on the host — the dedicated host's
     # public IP remains unaffected. UFW further restricts this to traffic
     # sourced from the flagship's private IP (10.0.0.2).