diff --git a/.github/scripts/demo-runtime-transaction.py b/.github/scripts/demo-runtime-transaction.py
index 436e74b46d..6f12dfebf2 100644
--- a/.github/scripts/demo-runtime-transaction.py
+++ b/.github/scripts/demo-runtime-transaction.py
@@ -27,7 +27,7 @@ PATHS = {"binary": Path("/opt/pulse/bin/pulse"),
          "unit": Path("/etc/systemd/system/pulse.service"),
          "dropins": Path("/etc/systemd/system/pulse.service.d"),
          "data": Path("/etc/pulse")}
-RELAY_HEALTH = "https://relay.pulserelay.pro/health"
+RELAY_HEALTH = "https://relay.pulserelay.pro/healthz"
 COUNT_KEYS = ("nodes", "vms_per_node", "lxcs_per_node", "docker_hosts",
               "docker_containers", "generic_hosts", "k8s_clusters", "k8s_nodes",
               "k8s_pods", "k8s_deployments")
diff --git a/.github/scripts/tests/demo_runtime_native.py b/.github/scripts/tests/demo_runtime_native.py
index b004b1cf05..0b7fc6a73b 100644
--- a/.github/scripts/tests/demo_runtime_native.py
+++ b/.github/scripts/tests/demo_runtime_native.py
@@ -38,11 +38,14 @@ def fail():
 if %r: threading.Thread(target=fail,daemon=True).start()
 class Handler(http.server.BaseHTTPRequestHandler):
     def do_GET(self):
+        expected = {'/healthz'} if %r == 17656 else {'/api/health','/api/version'}
+        if self.path not in expected:
+            self.send_response(404); self.end_headers(); return
         body=json.dumps({'version':VERSION} if self.path=='/api/version' else {'status':'healthy'}).encode()
         self.send_response(200); self.end_headers(); self.wfile.write(body)
     def log_message(self,*args): pass
 http.server.HTTPServer(('127.0.0.1',%r),Handler).serve_forever()
-''' % (version, fail_after, fail_after, port)).encode()
+''' % (version, fail_after, fail_after, port, port)).encode()
 
 
 def unit(executable, user="pulse"):
@@ -128,9 +131,9 @@ def main():
         original = (SCRIPTS / "demo-runtime-transaction.py").read_bytes()
         # Only the cohost endpoint is rebound. Transaction, paths, locking,
         # systemd, HTTP/TLS, estate, clocks and watches remain real and unchanged.
-        endpoint = b'https://relay.pulserelay.pro/health'
+        endpoint = b'https://relay.pulserelay.pro/healthz'
         assert original.count(endpoint) == 1
-        source = original.replace(endpoint, b'https://127.0.0.1:18444/health')
+        source = original.replace(endpoint, b'https://127.0.0.1:18444/healthz')
         result["original_engine_sha256"] = hashlib.sha256(original).hexdigest()
         result["fixture_engine_sha256"] = hashlib.sha256(source).hexdigest()
         result["bootstrap_sha256"] = hashlib.sha256(dispatcher.BOOTSTRAP.encode()).hexdigest()
diff --git a/.github/scripts/tests/test_demo_runtime_transaction.py b/.github/scripts/tests/test_demo_runtime_transaction.py
index c2fab87420..86bc90e60c 100644
--- a/.github/scripts/tests/test_demo_runtime_transaction.py
+++ b/.github/scripts/tests/test_demo_runtime_transaction.py
@@ -347,6 +347,9 @@ class TransactionTest(unittest.TestCase):
 
 
 class InputAndCommandTest(unittest.TestCase):
+    def test_cohost_check_uses_the_existing_relay_health_route(self):
+        self.assertEqual(engine.RELAY_HEALTH, "https://relay.pulserelay.pro/healthz")
+
     def test_valid_current_envelope(self):
         engine.validate(request())
         engine.validate(request("update"))
diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md
index f53a0ffd5d..c24547706f 100644
--- a/docs/release-control/v6/internal/subsystems/deployment-installability.md
+++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md
@@ -24,6 +24,9 @@ The mutating paths now share the Relay host's existing
 Every successful path, including a healthy no-op, needs a complete 300-second
 local/public/Relay health, version, service PID/restart and new-journal-crash
 window. Readiness is separate. Missing observations fail closed.
+The fixed Relay observation is its existing `/healthz` endpoint, not a guessed
+new route; disposable acceptance also rejects an unknown route rather than
+responding healthy to every URL.
 
 Before installation or runtime-profile mutation, stop only Pulse and durably
 capture its executable, unit/drop-ins and entire persistent data estate. Refuse