diff --git a/rosterchief/settings.py b/rosterchief/settings.py
index 941dffd..8d4929f 100644
--- a/rosterchief/settings.py
+++ b/rosterchief/settings.py
@@ -30,6 +30,12 @@ SECRET_KEY = config("DJANGO_SECRET_KEY")
 DEBUG = config("DJANGO_DEBUG", default=False, cast=bool)
 
 ALLOWED_HOSTS = config("DJANGO_ALLOWED_HOSTS", cast=Csv(), default="")
+# The loopback is always allowed, and it must be: the container's own healthcheck and the
+# deploy probe hit /healthz over 127.0.0.1/localhost, before any proxy has supplied a real
+# Host header. Without this they get a 400 and the container is marked unhealthy forever.
+# It widens nothing — gunicorn binds to the loopback only; the proxy owns the public domains.
+ALLOWED_HOSTS += [host for host in ("localhost", "127.0.0.1") if host not in ALLOWED_HOSTS]
+
 INTERNAL_IPS = config("DJANGO_INTERNAL_IPS", cast=Csv(), default="127.0.0.1")
 
 CSRF_TRUSTED_ORIGINS = config("DJANGO_CSRF_TRUSTED_ORIGINS", cast=Csv(), default="")
diff --git a/rosterchief/tests.py b/rosterchief/tests.py
index 3a46149..d7912b9 100644
--- a/rosterchief/tests.py
+++ b/rosterchief/tests.py
@@ -78,3 +78,11 @@ class HealthCheckTests(SimpleTestCase):
         response = self.client.get(reverse("healthz"))
 
         self.assertIn("no-cache", response["Cache-Control"])
+
+    @override_settings(ALLOWED_HOSTS=["example.com", "localhost", "127.0.0.1"])
+    def test_it_answers_over_the_loopback(self):
+        # The container healthcheck and the deploy probe hit it as 127.0.0.1/localhost, before
+        # a proxy supplies a real Host. If ALLOWED_HOSTS rejects those, /healthz 400s and the
+        # container is unhealthy forever — which is exactly how the first deploy failed.
+        for host in ("127.0.0.1", "localhost"):
+            self.assertEqual(self.client.get(reverse("healthz"), HTTP_HOST=host).status_code, 200, host)