diff --git a/prod-run.sh b/prod-run.sh
index b490bfb..17fde95 100755
--- a/prod-run.sh
+++ b/prod-run.sh
@@ -35,9 +35,7 @@ err()  { printf '[%s][error] %s\n' "$APP_NAME" "$*" >&2; }
 read_env_value() {
     local key="$1"
     [[ -f "$PROJECT_DIR/.env" ]] || return 1
-    grep -E "^${key}=" "$PROJECT_DIR/.env" | head -1 | cut -d= -f2- | sed "s/^[\'\"]//;s/[\'\"]$//" | tr -d $'
-'
-'
+    grep -E "^${key}=" "$PROJECT_DIR/.env" | head -1 | cut -d= -f2- | sed "s/^[\'\"]//;s/[\'\"]$//" | tr -d "\r"
 }
 
 resolve_health_url() {
@@ -88,14 +86,6 @@ is_port_listening() {
     fi
 }
 
-if id -u "$APP_NAME" >/dev/null 2>&1; then
-    chown -R "$APP_NAME:$APP_NAME" "$LOG_DIR" "$PROJECT_DIR/data"
-    chmod 0750 "$PROJECT_DIR/data" "$PROJECT_DIR/data/backups" "$LOG_DIR"
-    chmod 0640 "$MAIN_LOG" "$ERROR_LOG" "$ADMIN_EVENTS_LOG" "$SSHV_SESSIONS_FILE"
-else
-    warn "System user '$APP_NAME' not found — using $(id -un):$(id -gn)"
-fi
-
 say "Starting production runner"
 say "Project directory: $PROJECT_DIR"
 say "Running as: $(id -un) (uid=$(id -u) gid=$(id -g))"
@@ -120,6 +110,14 @@ mkdir -p "$PROJECT_DIR/data"
 mkdir -p "$PROJECT_DIR/data/backups"
 touch "$MAIN_LOG" "$ERROR_LOG" "$ADMIN_EVENTS_LOG" "$SSHV_SESSIONS_FILE"   # create if missing; safe on existing files
 
+if id -u "$APP_NAME" >/dev/null 2>&1; then
+    chown -R "$APP_NAME:$APP_NAME" "$LOG_DIR" "$PROJECT_DIR/data"
+    chmod 0750 "$PROJECT_DIR/data" "$PROJECT_DIR/data/backups" "$LOG_DIR"
+    chmod 0640 "$MAIN_LOG" "$ERROR_LOG" "$ADMIN_EVENTS_LOG" "$SSHV_SESSIONS_FILE"
+else
+    warn "System user '$APP_NAME' not found — using $(id -un):$(id -gn)"
+fi
+
 say "Ensured runtime directories and log files exist"
 
 # ---------------------------------------------------------
@@ -351,6 +349,23 @@ else
     PORT_STATUS="not-listening"
 fi
 
+SYSTEMD_ACTIVE="$(systemctl is-active "${APP_NAME}.service" 2>/dev/null || echo inactive)"
+HEALTH_URL="$(resolve_health_url)"
+HEALTH_PORT="${HEALTH_URL#*://127.0.0.1:}"
+HEALTH_PORT="${HEALTH_PORT%%/*}"
+
+if wait_for_health "$HEALTH_URL" 20 2; then
+    HEALTH_STATUS="healthy"
+else
+    HEALTH_STATUS="unhealthy"
+fi
+
+if is_port_listening "$HEALTH_PORT"; then
+    PORT_STATUS="listening"
+else
+    PORT_STATUS="not-listening"
+fi
+
 say "✔ Systemd service:     ${SYSTEMD_ACTIVE}"
 say "✔ Health URL:          ${HEALTH_URL}"
 say "✔ Health endpoint:     ${HEALTH_STATUS}"