diff --git a/dashcaddy-api/src/utilities/url-resolver.js b/dashcaddy-api/src/utilities/url-resolver.js
index a961466..398fc0f 100644
--- a/dashcaddy-api/src/utilities/url-resolver.js
+++ b/dashcaddy-api/src/utilities/url-resolver.js
@@ -9,10 +9,11 @@
  *
  * Priority:
  *   1. internet → https://www.google.com
- *   2. isExternal + externalUrl → use as-is
- *   3. service.url → prepend https:// if no protocol
- *   4. dnsServers config → http://{ip}:{port}
- *   5. fallback → buildServiceUrl(id)
+ *   2. healthCheckUrl → use as-is (bypass SSO/Caddy for direct container health checks)
+ *   3. isExternal + externalUrl → use as-is
+ *   4. service.url → prepend https:// if no protocol
+ *   5. dnsServers config → http://{ip}:{port}
+ *   6. fallback → buildServiceUrl(id)
  *
  * @param {string} id - service identifier
  * @param {Object|null} service - service object from services.json (may be null for top-card services)
@@ -22,6 +23,7 @@
  */
 function resolveServiceUrl(id, service, siteConfig, buildServiceUrl) {
   if (id === 'internet') return 'https://www.google.com';
+  if (service?.healthCheckUrl) return service.healthCheckUrl;
   if (service?.isExternal && service.externalUrl) return service.externalUrl;
   if (service?.url) return service.url.startsWith('http') ? service.url : `https://${service.url}`;
   const dnsServer = siteConfig?.dnsServers?.[id];