diff --git a/compose.yaml b/compose.yaml
index 9f33815..cb3eb4e 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -14,6 +14,7 @@ services:
       RMM_SESSION_SECRET: "${RMM_SESSION_SECRET:-dev-session-secret-change-me}"
       RMM_COOKIE_SECURE: "${RMM_COOKIE_SECURE:-false}"
       RMM_TUNNEL_HTTP_HOST: tunnel-ssh
+      RMM_TUNNEL_KEY_PATH: "${RMM_TUNNEL_KEY_PATH:-./secrets/router_tunnel_key.pub}"
     ports:
       - "${RMM_HTTP_BIND_IP:-0.0.0.0}:${RMM_HTTP_PORT:-18080}:8080"
     volumes:
@@ -28,7 +29,7 @@ services:
       - "${RMM_TUNNEL_BIND_IP:-0.0.0.0}:22000-22099:22000-22099"
     volumes:
       - tunnel-data:/data
-      - ./secrets/router_tunnel_key.pub:/bootstrap/router_tunnel_key.pub:ro
+      - "${RMM_TUNNEL_KEY_PATH}:/bootstrap/router_tunnel_key.pub:ro"
     restart: unless-stopped
 
 volumes:
diff --git a/deploy/tunnel/Dockerfile b/deploy/tunnel/Dockerfile
index ce379c4..ae9a729 100644
--- a/deploy/tunnel/Dockerfile
+++ b/deploy/tunnel/Dockerfile
@@ -1,6 +1,6 @@
 FROM alpine:3.21
 
-RUN apk add --no-cache openssh-server
+RUN apk add --no-cache openssh-server netcat-openbsd
 
 COPY sshd_config /etc/ssh/sshd_config
 COPY entrypoint.sh /usr/local/bin/tunnel-entrypoint
@@ -9,7 +9,7 @@ RUN chmod 0755 /usr/local/bin/tunnel-entrypoint
 EXPOSE 22 22000-22099
 VOLUME ["/data"]
 
-HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
-  CMD ssh-keyscan -T 2 -p 22 127.0.0.1 >/dev/null 2>&1 || exit 1
+HEALTHCHECK --interval=15s --timeout=3s --start-period=10s --retries=3 \
+  CMD nc -z 127.0.0.1 22 || exit 1
 
 ENTRYPOINT ["/usr/local/bin/tunnel-entrypoint"]