diff --git a/.gitea/workflows/snapshot_admin_deploy.yml b/.gitea/workflows/snapshot_admin_deploy.yml
index cd6c7d1..9c8af23 100644
--- a/.gitea/workflows/snapshot_admin_deploy.yml
+++ b/.gitea/workflows/snapshot_admin_deploy.yml
@@ -69,7 +69,21 @@ jobs:
           export SNAPSHOT_ADMIN_STATE_URL="http://127.0.0.1:8787/api/state"
           export SNAPSHOT_ADMIN_AUTH_USER="${SNAPSHOT_ADMIN_AUTH_USER:-}"
           export SNAPSHOT_ADMIN_AUTH_PASSWORD="${SNAPSHOT_ADMIN_AUTH_PASSWORD:-}"
-          bash tools/run_snapshot_admin_synology.sh healthcheck
+          echo "[deploy] wait for service readiness"
+          ready=0
+          for attempt in $(seq 1 30); do
+            if bash tools/run_snapshot_admin_synology.sh healthcheck; then
+              ready=1
+              break
+            fi
+            echo "[deploy] healthcheck retry $attempt/30"
+            sleep 2
+          done
+          if [ "$ready" -ne 1 ]; then
+            echo "[deploy] snapshot admin did not become ready in time"
+            tail -n 60 "$SNAPSHOT_ADMIN_LOG_FILE" || true
+            exit 1
+          fi
           if [ -n "$SNAPSHOT_ADMIN_AUTH_USER" ] && [ -n "$SNAPSHOT_ADMIN_AUTH_PASSWORD" ]; then
             curl -fsS -u "${SNAPSHOT_ADMIN_AUTH_USER}:${SNAPSHOT_ADMIN_AUTH_PASSWORD}" http://127.0.0.1:8787/api/state | python3 -c "import json,sys; print(json.load(sys.stdin)['version']['app'])"
           else