diff --git a/lib/towerops/application.ex b/lib/towerops/application.ex
index a7eca3c7..4351d605 100644
--- a/lib/towerops/application.ex
+++ b/lib/towerops/application.ex
@@ -8,7 +8,7 @@ defmodule Towerops.Application do
   @impl true
   def start(_type, _args) do
     # Run migrations on startup (Ecto handles locking for concurrent runs)
-    unless Application.get_env(:towerops, Towerops.Repo)[:database] == "towerops_test" do
+    if Application.get_env(:towerops, Towerops.Repo)[:database] != "towerops_test" do
       Towerops.Release.migrate()
     end
 
diff --git a/lib/towerops_web/controllers/health_controller.ex b/lib/towerops_web/controllers/health_controller.ex
new file mode 100644
index 00000000..3df50ca9
--- /dev/null
+++ b/lib/towerops_web/controllers/health_controller.ex
@@ -0,0 +1,9 @@
+defmodule ToweropsWeb.HealthController do
+  use ToweropsWeb, :controller
+
+  def index(conn, _params) do
+    conn
+    |> put_resp_content_type("text/plain")
+    |> send_resp(200, "ok")
+  end
+end
diff --git a/lib/towerops_web/router.ex b/lib/towerops_web/router.ex
index 5b6719b7..80c59658 100644
--- a/lib/towerops_web/router.ex
+++ b/lib/towerops_web/router.ex
@@ -18,6 +18,11 @@ defmodule ToweropsWeb.Router do
     plug :accepts, ["json"]
   end
 
+  # Health check endpoint for Kubernetes probes (no authentication required)
+  scope "/", ToweropsWeb do
+    get "/health", HealthController, :index
+  end
+
   scope "/", ToweropsWeb do
     pipe_through :browser