diff --git a/.github/workflows/breaking-change-guard.yml b/.github/workflows/breaking-change-guard.yml
index 96ebe620..c00ce7b6 100644
--- a/.github/workflows/breaking-change-guard.yml
+++ b/.github/workflows/breaking-change-guard.yml
@@ -81,18 +81,15 @@ jobs:
             BREAKING=1
           fi
 
-          # 4. Service key rename — public DNS contract on ccs-net depends on the
-          #    service key being "ccs". Docker's service-name DNS resolves sibling
-          #    containers via the compose service KEY (e.g. http://ccs:8317). A
-          #    rename from "ccs:" to anything else silently breaks every sibling
-          #    container in the wild even when image/network/container_name match.
+          # 4. Service key contract — Docker DNS on ccs-net uses the compose service
+          #    KEY as the hostname (e.g. http://ccs:8317). Renaming or removing
+          #    "ccs:" breaks every sibling container in the wild. Adding new service
+          #    keys (e.g. a sidecar) does NOT affect the "ccs" DNS contract and is
+          #    therefore allowed without a breaking-change marker.
           #
           #    Extraction logic: find lines that look like top-level service keys
           #    (two-space indent + identifier + colon, NOT sub-keys like "image:").
           #    This matches YAML service keys without requiring an external YAML parser.
-          OLD_KEYS=$(git show "${BASE}:docker/compose.yaml" 2>/dev/null \
-            | awk '/^services:/{s=1;next} s && /^  [a-zA-Z0-9_-]+:/{print $1} /^[^ ]/{s=0}' \
-            | tr -d ':' | sort | tr '\n' ' ' | sed 's/ $//')
           NEW_KEYS=$(awk '/^services:/{s=1;next} s && /^  [a-zA-Z0-9_-]+:/{print $1} /^[^ ]/{s=0}' \
             docker/compose.yaml \
             | tr -d ':' | sort | tr '\n' ' ' | sed 's/ $//')
@@ -100,10 +97,6 @@ jobs:
             echo "[!] BREAKING: services.ccs key missing from docker/compose.yaml — sibling containers on ccs-net rely on DNS hostname 'ccs'"
             BREAKING=1
           fi
-          if [[ "${OLD_KEYS}" != "${NEW_KEYS}" ]]; then
-            echo "[!] BREAKING: services keys changed: '${OLD_KEYS}' -> '${NEW_KEYS}'"
-            BREAKING=1
-          fi
 
           echo "breaking=${BREAKING}" >> "$GITHUB_OUTPUT"
 
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 5061e873..5e02fa60 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -342,10 +342,12 @@ jobs:
             "${{ steps.image.outputs.ref }}"
 
           echo "[i] Waiting for container healthcheck (up to 60s)..."
+          HEALTHY=0
           for i in $(seq 1 12); do
             STATUS=$(docker inspect "${CONTAINER_NAME}" --format='{{.State.Health.Status}}' 2>/dev/null || echo "missing")
             if [[ "${STATUS}" == "healthy" ]]; then
               echo "[OK] Container is healthy after $((i * 5))s"
+              HEALTHY=1
               break
             fi
             if [[ "${STATUS}" == "unhealthy" ]]; then
@@ -356,6 +358,12 @@ jobs:
             echo "    [${i}/12] status=${STATUS}, waiting 5s..."
             sleep 5
           done
+          if [[ "${HEALTHY}" -ne 1 ]]; then
+            echo "[X] Container did not become healthy within 60s (last status: ${STATUS})" >&2
+            docker logs "${CONTAINER_NAME}" --tail 100 >&2
+            docker inspect "${CONTAINER_NAME}" --format='{{json .State}}' >&2 || true
+            exit 1
+          fi
 
       - name: Run network-contract test
         run: |