diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index da128fa..f36ecac 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -55,12 +55,16 @@ jobs:
           exit 1
 
       - name: Wait for Redis / RabbitMQ / Elasticsearch
+        # --user rabbitmq is required: docker exec defaults to root, and Erlang tooling
+        # creates $HOME/.erlang.cookie mode 400 when it is missing. Probing a broker
+        # that is still booting would leave a root-owned cookie the server itself
+        # cannot read, crashing it with "reading .erlang.cookie: eacces".
         run: |
           for i in $(seq 1 60); do
             docker compose exec -T redis redis-cli ping 2>/dev/null | grep -q PONG \
               && docker compose exec -T ward-gateway-redis redis-cli ping 2>/dev/null | grep -q PONG \
-              && docker compose exec -T rabbitmq rabbitmq-diagnostics -q ping \
-              && docker compose exec -T ward-gateway-rabbitmq rabbitmq-diagnostics -q ping \
+              && docker compose exec -T --user rabbitmq rabbitmq rabbitmq-diagnostics -q ping \
+              && docker compose exec -T --user rabbitmq ward-gateway-rabbitmq rabbitmq-diagnostics -q ping \
               && docker compose exec -T elasticsearch curl -sf http://localhost:9200/_cluster/health >/dev/null \
               && echo "Redis, RabbitMQ, and Elasticsearch are ready" && exit 0
             echo "waiting for brokers ($i)..."
diff --git a/docker-compose.yml b/docker-compose.yml
index 300375e..993940e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -98,7 +98,11 @@ services:
       # Allow guest from host.docker.internal / CI runner (dev only).
       - ./infra/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
     healthcheck:
-      test: ["CMD", "rabbitmq-diagnostics", "ping"]
+      # The image sets no USER, so healthchecks run as root. Any Erlang tool creates
+      # $HOME/.erlang.cookie (mode 400) if it is absent — and HOME is /var/lib/rabbitmq
+      # for root too. A root-run check that beats the booting server to the cookie
+      # locks the broker out of its own file: "reading .erlang.cookie: eacces".
+      test: ["CMD-SHELL", "su rabbitmq -s /bin/sh -c 'rabbitmq-diagnostics -q ping'"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -193,7 +197,8 @@ services:
     volumes:
       - ./infra/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
     healthcheck:
-      test: ["CMD", "rabbitmq-diagnostics", "ping"]
+      # Drops to rabbitmq for the same .erlang.cookie reason as the rabbitmq service.
+      test: ["CMD-SHELL", "su rabbitmq -s /bin/sh -c 'rabbitmq-diagnostics -q ping'"]
       interval: 10s
       timeout: 5s
       retries: 5