diff --git a/Makefile b/Makefile
index 49442f5..6e60f21 100644
--- a/Makefile
+++ b/Makefile
@@ -47,7 +47,7 @@ unit:
 
 ## smoke: compose up (wait for healthy), curl /health, then tear down
 smoke:
-	docker compose -f $(COMPOSE) up -d --build --wait
+	docker compose -f $(COMPOSE) up -d --build --wait --wait-timeout 300
 	bash -c 'curl -fsS $(HEALTH_URL); rc=$$?; docker compose -f $(COMPOSE) down --volumes; exit $$rc'
 
 ## down: stop and remove the local stack
diff --git a/infra/docker-compose.yml b/infra/docker-compose.yml
index 1f5ad2a..699813e 100644
--- a/infra/docker-compose.yml
+++ b/infra/docker-compose.yml
@@ -33,10 +33,13 @@ services:
     volumes:
       - oz-db:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak"]
+      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
+      # so oz-init migrations can safely start (avoids race on cold container start).
+      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
       interval: 5s
-      timeout: 3s
-      retries: 10
+      timeout: 5s
+      retries: 30
+      start_period: 15s
     networks: [cg]
 
   oz-redis:
@@ -66,7 +69,7 @@ services:
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:
-      - ./openzaak/setup_configuration:/app/setup_configuration:ro,z
+      - ./openzaak/setup_configuration:/app/setup_configuration:ro
     depends_on:
       oz-db:
         condition: service_healthy
@@ -142,7 +145,7 @@ services:
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:
-      - ./opennotificaties/setup_configuration:/app/setup_configuration:ro,z
+      - ./opennotificaties/setup_configuration:/app/setup_configuration:ro
     depends_on:
       nrc-db:
         condition: service_healthy
@@ -191,7 +194,7 @@ services:
     ports:
       - "8180:8080"
     volumes:
-      - ./keycloak/realms:/opt/keycloak/data/import:ro,z
+      - ./keycloak/realms:/opt/keycloak/data/import:ro
     networks: [cg]
 
   # ── Flowable (S-03) ──────────────────────────────────────────────────────
@@ -228,7 +231,7 @@ services:
     image: docker.io/curlimages/curl:latest
     restart: "no"
     volumes:
-      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro,z
+      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro
     command:
       - sh
       - -c
diff --git a/infra/openzaak/docker-compose.yml b/infra/openzaak/docker-compose.yml
index 6316eaa..b61bfe9 100644
--- a/infra/openzaak/docker-compose.yml
+++ b/infra/openzaak/docker-compose.yml
@@ -18,10 +18,13 @@ services:
     volumes:
       - oz-db:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak"]
+      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
+      # so oz-init migrations can safely start (avoids race on cold container start).
+      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
       interval: 5s
-      timeout: 3s
-      retries: 10
+      timeout: 5s
+      retries: 30
+      start_period: 15s
     networks: [cg]
 
   oz-redis:
@@ -53,9 +56,7 @@ services:
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:
-      # :z relabels for SELinux; the dir/file must be world-readable for the
-      # container user (rootless Podman uid mapping). See docs/runbooks/openzaak.md.
-      - ./setup_configuration:/app/setup_configuration:ro,z
+      - ./setup_configuration:/app/setup_configuration:ro
     depends_on:
       oz-db:
         condition: service_healthy