diff --git a/scripts/health.py b/scripts/health.py
index bbc39a8b..04f3795a 100644
--- a/scripts/health.py
+++ b/scripts/health.py
@@ -367,8 +367,9 @@ def collect_snapshot(values: dict[str, str], *, root: Path = Path("/"), run: Run
         timers["updates"] = _unit_state(run, "apt-daily-upgrade.timer", timer=True, max_age_seconds=172800)
         services["updates"] = _unit_state(run, "apt-daily-upgrade.service")
     if values.get("CI_FLEET_HEALTH_BOOTSTRAP") == "1":
-        # ponytail: activation validates unit installation separately; scheduled runs verify live timers after enablement.
+        # ponytail: activation validates unit installation separately; scheduled runs verify maintenance state after commit.
         timers = {name: "ok" for name in timers}
+        services = {name: "ok" for name in services}
     instance = values.get("CI_FLEET_INSTANCE", "unknown")
     stale = _stale_resources(run, instance) if docker_ok else {"containers": 0, "networks": 0, "volumes": 0}
     stale["images"] = _count(run, ["docker", "images", "-q", "--filter", "dangling=true", "--filter", "label=io.randomdevelopment.ci-fleet.managed=true"]) if docker_ok else 0
diff --git a/scripts/install-worker-controller.sh b/scripts/install-worker-controller.sh
index 29d8a692..37b3f252 100755
--- a/scripts/install-worker-controller.sh
+++ b/scripts/install-worker-controller.sh
@@ -929,7 +929,7 @@ restore_checkpoint() {
         failed=1
       else
         compose "$release_dir" "$rendered_env" up -d --no-deps controller || failed=1
-        if ((failed == 0)); then run_health_check "$release_dir" "$rendered_env" || failed=1; fi
+        if ((failed == 0)); then run_health_check "$release_dir" "$rendered_env" true || failed=1; fi
       fi
     fi
   fi
diff --git a/scripts/test_health.py b/scripts/test_health.py
index 4f385c1b..8fa8e741 100644
--- a/scripts/test_health.py
+++ b/scripts/test_health.py
@@ -157,7 +157,7 @@ def test_collector_uses_sustained_metrics_and_all_service_units(self) -> None:
             pressure = root / "proc/pressure/memory"
             pressure.write_text("some avg10=0.00 avg60=0.05 avg300=0.20 total=1\n")
             def run(args):
-                output = "yes\n" if args[0] == "timedatectl" else "success\n" if args[0] == "systemctl" else ""
+                output = "yes\n" if args[0] == "timedatectl" else "failed\n" if args[:2] == ["systemctl", "show"] and args[2].endswith(".service") else "success\n" if args[0] == "systemctl" else ""
                 return health.subprocess.CompletedProcess(args, 1 if args[:2] == ["docker", "info"] else 0, output, "")
 
             original_load, original_cpus = health.os.getloadavg, health.os.cpu_count
@@ -183,6 +183,7 @@ def run(args):
                     run=run,
                 )
                 self.assertEqual(set(remote["services"]), {"cleanup", "drift", "reconcile"})
+                self.assertEqual(set(remote["services"].values()), {"ok"})
                 self.assertEqual(set(remote["timers"]), {"health", "cleanup", "drift", "reconcile"})
                 self.assertEqual(remote["reconciliation"]["status"], "bootstrap")
                 (root / "etc").mkdir()