diff --git a/docker/chatmail_relay.dockerfile b/docker/chatmail_relay.dockerfile
index 972ed9f1..3b08ad2c 100644
--- a/docker/chatmail_relay.dockerfile
+++ b/docker/chatmail_relay.dockerfile
@@ -8,7 +8,7 @@ RUN echo 'APT::Install-Recommends "0";' > /etc/apt/apt.conf.d/01norecommend && \
     apt-get install -y \
         ca-certificates && \
     DEBIAN_FRONTEND=noninteractive \
-    TZ=Europe/London \
+    TZ=UTC \
     apt-get install -y tzdata && \
     apt-get install -y locales && \
     sed -i -e "s/# $LANG.*/$LANG UTF-8/" /etc/locale.gen && \
@@ -16,9 +16,6 @@ RUN echo 'APT::Install-Recommends "0";' > /etc/apt/apt.conf.d/01norecommend && \
     update-locale LANG=$LANG \
     && rm -rf /var/lib/apt/lists/*
 
-# Dovecot is installed by the pyinfra install stage below (DovecotDeployer),
-# which downloads+verifies SHA256 hashes from the canonical source in
-# cmdeploy/src/cmdeploy/dovecot/deployer.py — no need to duplicate here.
 RUN apt-get update && \
     apt-get install -y \
         git \
@@ -42,8 +39,6 @@ RUN apt-get update && \
         cron \
     && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /opt/chatmail
-
 # --- Build-time: install cmdeploy venv and run install stage ---
 # Editable install so importlib.resources reads directly from the source tree.
 # On container start only "configure,activate" stages run.
@@ -76,10 +71,14 @@ ARG SETUP_CHATMAIL_SERVICE_PATH=/lib/systemd/system/setup_chatmail.service
 COPY ./docker/files/setup_chatmail.service "$SETUP_CHATMAIL_SERVICE_PATH"
 RUN ln -sf "$SETUP_CHATMAIL_SERVICE_PATH" "/etc/systemd/system/multi-user.target.wants/setup_chatmail.service"
 
+# Remove default nginx site config at build time (not in entrypoint)
+RUN rm -f /etc/nginx/sites-enabled/default
+
 COPY --chmod=555 ./docker/files/setup_chatmail_docker.sh /setup_chatmail_docker.sh
 COPY --chmod=555 ./docker/files/entrypoint.sh /entrypoint.sh
 
-VOLUME ["/sys/fs/cgroup", "/home"]
+HEALTHCHECK --interval=60s --timeout=10s --retries=3 \
+  CMD systemctl is-active dovecot postfix nginx unbound opendkim filtermail doveauth chatmail-metadata || exit 1
 
 STOPSIGNAL SIGRTMIN+3
 
diff --git a/docker/files/entrypoint.sh b/docker/files/entrypoint.sh
index 8c1e825f..669acd0b 100755
--- a/docker/files/entrypoint.sh
+++ b/docker/files/entrypoint.sh
@@ -1,8 +1,6 @@
 #!/bin/bash
 set -eo pipefail
 
-unlink /etc/nginx/sites-enabled/default || true
-
 SETUP_CHATMAIL_SERVICE_PATH="${SETUP_CHATMAIL_SERVICE_PATH:-/lib/systemd/system/setup_chatmail.service}"
 
 # Whitelist only the env vars needed by setup_chatmail_docker.sh.