diff --git a/docker-compose.yml b/docker-compose.yml
index 6de09e1c..52098b48 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -130,6 +130,9 @@ services:
       # Set EXTRA_SANS to include the host's LAN IP in the TLS certificate.
       # Example: EXTRA_SANS=IP:10.0.0.5
       - EXTRA_SANS=${EXTRA_SANS:-}
+    # Caddy is PID 1 and reaps nothing; busybox wget's ssl_client helper from the healthcheck is
+    # orphaned to it and stays a zombie (one per check).  init runs tini as PID 1 to reap them.
+    init: true
     healthcheck:
       test: [ 'CMD-SHELL', 'wget --spider --no-check-certificate https://127.0.0.1:443 || exit 1' ]
       interval: 1m
@@ -165,5 +168,5 @@ services:
     volumes:
       - './docker/help/wrolpi-help:/opt/wrolpi-help'
     healthcheck:
-      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:8086' ]
+      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:80' ]  # mkdocs serves on 80; 8086 is Caddy's proxy.
       interval: 1m
diff --git a/docker/zim/Dockerfile b/docker/zim/Dockerfile
index 426d6b95..e771ba9f 100644
--- a/docker/zim/Dockerfile
+++ b/docker/zim/Dockerfile
@@ -1,7 +1,8 @@
 FROM debian:13
 ENV DOCKER=true
 
-RUN apt update && apt-get install -y kiwix kiwix-tools
+# curl is for the compose healthcheck.
+RUN apt update && apt-get install -y kiwix kiwix-tools curl
 
 # Committed blobs (e.g. the default Zim served when the media directory has no
 # functioning zim files).