diff --git a/PROJECTS/beginner/canary-token-generator/backend/cmd/healthcheck/main.go b/PROJECTS/beginner/canary-token-generator/backend/cmd/healthcheck/main.go
new file mode 100644
index 00000000..7ec82cf2
--- /dev/null
+++ b/PROJECTS/beginner/canary-token-generator/backend/cmd/healthcheck/main.go
@@ -0,0 +1,27 @@
+// ©AngelaMos | 2026
+// main.go
+
+package main
+
+import (
+	"net/http"
+	"os"
+	"time"
+)
+
+const (
+	healthURL  = "http://127.0.0.1:8080/healthz"
+	httpDialTO = 2 * time.Second
+)
+
+func main() {
+	client := &http.Client{Timeout: httpDialTO}
+	resp, err := client.Get(healthURL)
+	if err != nil {
+		os.Exit(1)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		os.Exit(1)
+	}
+}
diff --git a/PROJECTS/beginner/canary-token-generator/backend/healthcheck b/PROJECTS/beginner/canary-token-generator/backend/healthcheck
new file mode 100755
index 00000000..1da49c71
Binary files /dev/null and b/PROJECTS/beginner/canary-token-generator/backend/healthcheck differ
diff --git a/PROJECTS/beginner/canary-token-generator/compose.yml b/PROJECTS/beginner/canary-token-generator/compose.yml
index ed8bbfe5..80b5b70e 100644
--- a/PROJECTS/beginner/canary-token-generator/compose.yml
+++ b/PROJECTS/beginner/canary-token-generator/compose.yml
@@ -65,7 +65,7 @@ services:
       redis:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:8080/healthz"]
+      test: ["CMD", "/healthcheck"]
       interval: 10s
       timeout: 5s
       retries: 3
diff --git a/PROJECTS/beginner/canary-token-generator/infra/docker/canary.prod b/PROJECTS/beginner/canary-token-generator/infra/docker/canary.prod
index 246d7db1..58428b6b 100644
--- a/PROJECTS/beginner/canary-token-generator/infra/docker/canary.prod
+++ b/PROJECTS/beginner/canary-token-generator/infra/docker/canary.prod
@@ -27,11 +27,18 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
     -o /out/canary \
     ./cmd/canary
 
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -trimpath \
+    -ldflags="-s -w" \
+    -o /out/healthcheck \
+    ./cmd/healthcheck
+
 FROM gcr.io/distroless/static:nonroot AS final
 
 WORKDIR /
 
 COPY --from=builder /out/canary /canary
+COPY --from=builder /out/healthcheck /healthcheck
 COPY --from=builder /src/config.yaml /config.yaml
 
 EXPOSE 8080
diff --git a/PROJECTS/beginner/canary-token-generator/justfile b/PROJECTS/beginner/canary-token-generator/justfile
index 3f370127..f7b18231 100644
--- a/PROJECTS/beginner/canary-token-generator/justfile
+++ b/PROJECTS/beginner/canary-token-generator/justfile
@@ -3,9 +3,6 @@
 # justfile
 # =============================================================================
 
-set dotenv-filename := ".env.development"
-set dotenv-load
-set export
 set shell := ["bash", "-uc"]
 set windows-shell := ["powershell.exe", "-NoLogo", "-Command"]
 
@@ -168,6 +165,14 @@ tunnel-start *ARGS:
 tunnel-down *ARGS:
     docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml down {{ARGS}}
 
+[group('tunnel')]
+tunnel-build *ARGS:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml build {{ARGS}}
+
+[group('tunnel')]
+tunnel-rebuild:
+    docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml build --no-cache
+
 [group('tunnel')]
 tunnel-logs:
     docker compose --env-file .env -f compose.yml -f cloudflared.compose.yml logs -f cloudflared
@@ -178,35 +183,35 @@ tunnel-logs:
 
 [group('dev')]
 dev-up *ARGS:
-    docker compose -f dev.compose.yml up {{ARGS}}
+    docker compose --env-file .env.development -f dev.compose.yml up {{ARGS}}
 
 [group('dev')]
 dev-start *ARGS:
-    docker compose -f dev.compose.yml up -d {{ARGS}}
+    docker compose --env-file .env.development -f dev.compose.yml up -d {{ARGS}}
 
 [group('dev')]
 dev-down *ARGS:
-    docker compose -f dev.compose.yml down {{ARGS}}
+    docker compose --env-file .env.development -f dev.compose.yml down {{ARGS}}
 
 [group('dev')]
 dev-stop:
-    docker compose -f dev.compose.yml stop
+    docker compose --env-file .env.development -f dev.compose.yml stop
 
 [group('dev')]
 dev-build *ARGS:
-    docker compose -f dev.compose.yml build {{ARGS}}
+    docker compose --env-file .env.development -f dev.compose.yml build {{ARGS}}
 
 [group('dev')]
 dev-rebuild:
-    docker compose -f dev.compose.yml build --no-cache
+    docker compose --env-file .env.development -f dev.compose.yml build --no-cache
 
 [group('dev')]
 dev-logs *SERVICE:
-    docker compose -f dev.compose.yml logs -f {{SERVICE}}
+    docker compose --env-file .env.development -f dev.compose.yml logs -f {{SERVICE}}
 
 [group('dev')]
 dev-ps:
-    docker compose -f dev.compose.yml ps
+    docker compose --env-file .env.development -f dev.compose.yml ps
 
 # =============================================================================
 # Utilities