diff --git a/infrastructure/scripts/os-update/update-cp-node.sh b/infrastructure/scripts/os-update/update-cp-node.sh
index 78b38d2..f161048 100755
--- a/infrastructure/scripts/os-update/update-cp-node.sh
+++ b/infrastructure/scripts/os-update/update-cp-node.sh
@@ -473,15 +473,24 @@ phase_reboot() {
   if [ "$DRY_RUN" != "1" ]; then
     local deadline=$(( $(date +%s) + REBOOT_MAX_WAIT_SECONDS ))
     local code=000
+    # /livez is auth-gated on this cluster (returns 401 without a bearer token).
+    # Any HTTP response from the api-server (200/401/403) means it is up and
+    # serving; only network-level failures (000, connection refused) count as
+    # "not yet back". curl --max-time keeps the poll cycle snappy after reboot.
     while [ $(date +%s) -lt $deadline ]; do
-      code=$(curl -sk -o /dev/null -w '%{http_code}' "https://$TARGET_HOST:6443/livez" 2>/dev/null || echo 000)
-      if [ "$code" = "200" ]; then
-        log "  $NODE api-server /livez=200"
-        break
-      fi
+      code=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 5 "https://$TARGET_HOST:6443/livez" 2>/dev/null || echo 000)
+      case "$code" in
+        200|401|403)
+          log "  $NODE api-server responding (/livez HTTP $code)"
+          break
+          ;;
+      esac
       sleep 5
     done
-    [ "$code" = "200" ] || die "$NODE api-server did not return within ${REBOOT_MAX_WAIT_SECONDS}s -- escalate; check 'hcloud server describe $NODE' and Hetzner console"
+    case "$code" in
+      200|401|403) : ;;
+      *) die "$NODE api-server did not return within ${REBOOT_MAX_WAIT_SECONDS}s (last code=$code) -- escalate; check 'hcloud server describe $NODE' and Hetzner console" ;;
+    esac
   fi
 
   log "-- verify etcd cluster status from peer ($PEER_HOST) -- $NODE should be 'started'"