diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml
index b63ce4a..4e30848 100644
--- a/platform/vpn-egress/gluetun-gateway.yaml
+++ b/platform/vpn-egress/gluetun-gateway.yaml
@@ -72,9 +72,14 @@ spec:
             - name: control
               containerPort: 8000              # Gluetun control API (health + tunnel-state lookup)
           livenessProbe:
-            httpGet: { path: /v1/openvpn/status, port: 8000 }   # Gluetun control API health
-            initialDelaySeconds: 20
+            # EXEC (localhost) not httpGet: once the tunnel redirects the default route via tun0, the pod's
+            # response to a kubelet HTTP probe would egress the tunnel and never return → probe times out →
+            # needless restarts. A local wget stays on lo, unaffected by the VPN routing.
+            exec:
+              command: ["/bin/sh", "-c", "wget -qO- http://127.0.0.1:8000/v1/vpn/status | grep -q running"]
+            initialDelaySeconds: 30
             periodSeconds: 30
+            timeoutSeconds: 5
           resources:
             requests:
               cpu: 50m