diff --git a/health-agent/pyproject.toml b/health-agent/pyproject.toml
index 7c3b34e..faa901c 100644
--- a/health-agent/pyproject.toml
+++ b/health-agent/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "health-agent"
-version = "0.2.0"
+version = "0.2.1"
 description = "iklim.co Monitoring Health Agent"
 requires-python = ">=3.12"
 dependencies = [
diff --git a/health-agent/src/health_agent/checks/tls.py b/health-agent/src/health_agent/checks/tls.py
index b7cb1ed..157ca56 100644
--- a/health-agent/src/health_agent/checks/tls.py
+++ b/health-agent/src/health_agent/checks/tls.py
@@ -14,7 +14,7 @@ def check_swag_tls():
     cert_path = "/mnt/storagebox/ssl/STAR.iklim.co.full.crt"
     domain = os.getenv("EXTERNAL_DOMAIN", "iklim.co")
     suffix = os.getenv("EXTERNAL_SUBDOMAIN_SUFFIX", "")
-    target_url = f"https://api{suffix}.{domain}/actuator/health"
+    target_url = f"https://api{suffix}.{domain}/health"
 
     msg_parts = []
     is_down = False
@@ -41,17 +41,21 @@ def check_swag_tls():
             is_down = True
             msg_parts.append(f"cert parse error: {e}")
             
-    # 2. Check external HTTPS reachable
+    # 2. Check external HTTPS reachable with real TLS verification,
+    # so the served certificate chain is validated, not just the file on disk
     try:
-        r = requests.get(target_url, timeout=5, verify=False)
-        if r.status_code < 500:
+        r = requests.get(target_url, timeout=5)
+        if r.status_code == 200:
             msg_parts.append("HTTPS reachable")
         else:
             is_down = True
             msg_parts.append(f"HTTPS returned {r.status_code}")
-    except Exception as e:
+    except requests.exceptions.SSLError:
         is_down = True
-        msg_parts.append(f"HTTPS unreachable")
+        msg_parts.append("TLS verification failed")
+    except Exception:
+        is_down = True
+        msg_parts.append("HTTPS unreachable")
         
     ping_ms = int((time.time() - start_t) * 1000)
     msg = " | ".join(msg_parts)