diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cb7ea26..f3db572 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,14 +22,19 @@ jobs:
         include:
           - goos: linux
             goarch: amd64
+            suffix: ""
           - goos: linux
             goarch: arm64
+            suffix: ""
           - goos: darwin
             goarch: amd64
+            suffix: ""
           - goos: darwin
             goarch: arm64
+            suffix: ""
           - goos: windows
             goarch: amd64
+            suffix: ".exe"
     steps:
       - uses: actions/checkout@v4
 
@@ -62,13 +67,9 @@ jobs:
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goarch }}
         run: |
-          SUFFIX=""
-          if [ "${{ matrix.goos }}" = "windows" ]; then
-            SUFFIX=".exe"
-          fi
           go build \
             -ldflags "-s -w -X main.version=${{ steps.version.outputs.VERSION }}" \
-            -o "synapbus${SUFFIX}" \
+            -o "synapbus${{ matrix.suffix }}" \
             ./cmd/synapbus/
 
       - name: Create archive
diff --git a/cmd/synapbus/main.go b/cmd/synapbus/main.go
index 1aad974..9396133 100644
--- a/cmd/synapbus/main.go
+++ b/cmd/synapbus/main.go
@@ -423,6 +423,15 @@ func runServe(cmd *cobra.Command, args []string) error {
 		r.Handle("/metrics", promhttp.Handler())
 	}
 
+	// Kubernetes-style health probes (no auth, always registered)
+	r.Get("/healthz", healthChecker.Healthz)
+	r.Get("/readyz", healthChecker.Readyz)
+
+	// Prometheus metrics endpoint (only when enabled)
+	if metricsEnabled {
+		r.Handle("/metrics", promhttp.Handler())
+	}
+
 	// Auth endpoints (public)
 	r.Post("/auth/register", withHumanAgent(authHandlers.HandleRegister, userStore, agentService, channelService))
 	r.Post("/auth/login", withHumanAgent(authHandlers.HandleLogin, userStore, agentService, channelService))