diff --git a/src/aou-sas/Dockerfile b/src/aou-sas/Dockerfile
index 309895d94..709471909 100644
--- a/src/aou-sas/Dockerfile
+++ b/src/aou-sas/Dockerfile
@@ -78,6 +78,12 @@ RUN PROXY_CONF=/etc/httpd/conf.d/dkrapro-proxy.conf && \
 ###############################################################################
 RUN mkdir -p /data && chown aou:aougroup /data
 
+# SAS Studio takes ~40s to start inside the container.  The Docker
+# HEALTHCHECK lets the host-level readiness probe (probe-proxy-readiness.sh)
+# wait for HTTP 200 before marking startup_script/status=COMPLETE.
+HEALTHCHECK --interval=5s --timeout=3s --start-period=60s --retries=3 \
+  CMD curl -sf http://localhost:7080/SASStudio/ || exit 1
+
 # Wrapper entrypoint: copies the SAS license from Mikey Secrets (if active)
 # to /sasinside/ before handing off to the SAS entrypoint.
 COPY --from=wb-secret-receiver /dist/wb-secret-receiver /wb-secret-receiver
diff --git a/startupscript/butane/probe-proxy-readiness.sh b/startupscript/butane/probe-proxy-readiness.sh
index 01433f884..d124a516a 100644
--- a/startupscript/butane/probe-proxy-readiness.sh
+++ b/startupscript/butane/probe-proxy-readiness.sh
@@ -11,9 +11,12 @@ set -o xtrace
 # shellcheck source=/dev/null
 source /home/core/metadata-utils.sh
 
+APP_HEALTH="$(docker inspect --format='{{.State.Health.Status}}' application-server 2>/dev/null || echo "none")"
+
 if docker ps -q --filter "name=proxy-agent" | grep -q . \
-    && docker ps -q --filter "name=application-server" | grep -q .; then
-    echo "Proxy is ready."
+    && docker ps -q --filter "name=application-server" | grep -q . \
+    && [[ "${APP_HEALTH}" == "healthy" || "${APP_HEALTH}" == "none" ]]; then
+    echo "Proxy is ready (application-server health: ${APP_HEALTH})."
     status="$(get_guest_attribute "startup_script/status" "")"
     isSuccess="false"
     if [[ "${status}" != "ERROR" ]]; then