diff --git a/CHANGELOG.md b/CHANGELOG.md
index 48422bc..700a5af 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,10 @@ CalVer image tags (`stable-YYYY.MM.N`, `dev-YYYY.MM.N`) are produced for every C
 <!-- Add bullets here. Group: Added / Changed / Fixed / Removed / Internal.
      Mark breaking changes with **BREAKING** at the start of the bullet. -->
 
+### Internal
+
+- Fix nightly `docker-e2e` CI failures: refresh two stale assertions that had drifted from the live API. `tests/test_docker_full.py::test_app_returns_html_on_root` now expects the auth-aware `302 → /login` (root has redirected since the auth middleware landed); `tests/test_e2e_docker.py::TestDockerHealth::test_health_has_duckdb` now reads `services["duckdb_state"]` (current health-payload shape, already validated by `tests/test_api.py`). No application behavior change — these only ran in the scheduled nightly job, so the drift went unnoticed for several PRs.
+
 ## [0.11.1] — 2026-04-26
 
 Patch release — hotfix the missed Caddy env passthrough that should have shipped with 0.11.0, plus codify changelog discipline so this kind of drift gets caught at PR review time next time.
diff --git a/tests/test_docker_full.py b/tests/test_docker_full.py
index 7026c4d..caa06eb 100644
--- a/tests/test_docker_full.py
+++ b/tests/test_docker_full.py
@@ -49,9 +49,10 @@ def test_app_health():
 
 
 def test_app_returns_html_on_root():
-    """GET / returns 200 (HTML dashboard)."""
-    resp = httpx.get(f"{DOCKER_BASE_URL}/", timeout=10)
-    assert resp.status_code == 200
+    """GET / redirects unauthenticated callers — / always 302s to /login or /dashboard."""
+    resp = httpx.get(f"{DOCKER_BASE_URL}/", timeout=10, follow_redirects=False)
+    assert resp.status_code == 302
+    assert resp.headers.get("location") in ("/login", "/dashboard")
 
 
 def test_bootstrap_creates_admin():
diff --git a/tests/test_e2e_docker.py b/tests/test_e2e_docker.py
index 0162a20..277657e 100644
--- a/tests/test_e2e_docker.py
+++ b/tests/test_e2e_docker.py
@@ -78,8 +78,9 @@ class TestDockerHealth:
         import httpx
         resp = httpx.get(f"{docker_env}/api/health")
         data = resp.json()
-        checks = data.get("checks", {})
-        assert "duckdb" in checks or "database" in checks
+        services = data.get("services", {})
+        assert "duckdb_state" in services
+        assert services["duckdb_state"]["status"] == "ok"
 
 
 class TestDockerFullFlow: