diff --git a/.dockerignore b/.dockerignore
index 3cbf0a8..9d9544a 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -10,6 +10,8 @@ design/
 node_modules
 web/node_modules
 web/dist
+# Generated embed output; the Go stage takes the PWA from the web stage.
+internal/frontend/dist/
 bin/
 *.db
 *.db-*
diff --git a/Dockerfile b/Dockerfile
index 869a9d7..9ef5a49 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,8 +32,11 @@ ENV MEALQUEST_HTTP_ADDR=:8080 \
 VOLUME /data
 EXPOSE 8080
 USER 10001:10001
-# Probe the port from MEALQUEST_HTTP_ADDR (text after the last colon) so an
-# overridden listen address stays healthy.
+# Probe the listener from MEALQUEST_HTTP_ADDR: host is everything before the
+# last colon (IPv6 keeps its brackets). Wildcard hosts map to loopback, as
+# does localhost: Go listens on its IPv4 address but wget would try ::1.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD wget -q -O /dev/null "http://127.0.0.1:${MEALQUEST_HTTP_ADDR##*:}/health" || exit 1
+    CMD host="${MEALQUEST_HTTP_ADDR%:*}"; \
+    case "$host" in ""|0.0.0.0|"[::]"|localhost) host=127.0.0.1 ;; esac; \
+    wget -q -O /dev/null "http://${host}:${MEALQUEST_HTTP_ADDR##*:}/health" || exit 1
 ENTRYPOINT ["/usr/local/bin/mealquest"]
diff --git a/Makefile b/Makefile
index bbdf37e..e9f157a 100644
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,10 @@
 #   make docker  Build the container image from ./Dockerfile.
 
 FRONTEND_DIST := internal/frontend/dist
-VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+# Dirty means a tracked change outside the generated embed output, which
+# `make embed` rewrites; plain `--dirty` would flag every rebuild.
+GIT_DIRTY := $(shell git status --porcelain --untracked-files=no -- . ':(exclude)$(FRONTEND_DIST)' 2>/dev/null)
+VERSION ?= $(shell git describe --tags --always 2>/dev/null || echo dev)$(if $(GIT_DIRTY),-dirty)
 IMAGE ?= mealquest:$(VERSION)
 LDFLAGS := -s -w -X main.version=$(VERSION)