diff --git a/.gitea/workflows/rebuild.yml b/.gitea/workflows/rebuild.yml
index 8765bd1..65fb730 100644
--- a/.gitea/workflows/rebuild.yml
+++ b/.gitea/workflows/rebuild.yml
@@ -26,7 +26,7 @@ jobs:
             --name voice \
             --network host \
             --restart unless-stopped \
-            --health-cmd='curl -sk https://localhost:${WEB_PORT:-9178}/ -o /dev/null && curl -s http://localhost:7880/ -o /dev/null' \
+            --health-cmd='curl -sk https://localhost:${WEB_PORT:-9178}/ -o /dev/null && curl -s http://localhost:7880/ -o /dev/null && curl -s http://localhost:${MEDIA_SERVER_PORT:-8092}/media/api/healthz -o /dev/null' \
             --health-interval=15s \
             --health-timeout=5s \
             --health-retries=3 \
@@ -34,6 +34,7 @@ jobs:
             -v /mnt/user/dev/hope-voice-api/certs:/etc/voice/certs \
             -v /mnt/user/dev/hope-voice-api/skills:/skills \
             -v /mnt/user/dev/hope-voice-api/livekit.yaml:/etc/livekit.yaml:ro \
+            -v /mnt/user/dev/hope-voice-api/media:/data/media \
             -e LIVEKIT_URL=http://localhost:7880 \
             -e LIVEKIT_API_KEY=devkey \
             -e LIVEKIT_API_SECRET=hopevoice-devsecret-2026-lan-only \
@@ -48,6 +49,9 @@ jobs:
             -e WEB_PORT=9178 \
             -e VOICE_USERS_FILE=/etc/hope/users.json \
             -e VOICE_DEFAULT_USER=shane \
+            -e MEDIA_DIR=/data/media \
+            -e MEDIA_SERVER_PORT=8092 \
+            -e YTDLP_COOKIES=/data/media/cookies.txt \
             hope-voice-api-voice:latest
 
       - name: Verify deployment
diff --git a/docker-compose.yml b/docker-compose.yml
index 296cd6d..18c65a9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,7 +20,7 @@ services:
       VOICE_DEFAULT_USER: "${VOICE_DEFAULT_USER:-shane}"
       MEDIA_DIR: "/data/media"
       MEDIA_SERVER_PORT: "${MEDIA_SERVER_PORT:-8092}"
-      YTDLP_COOKIES: "${YTDLP_COOKIES:-}"
+      YTDLP_COOKIES: "${YTDLP_COOKIES:-/data/media/cookies.txt}"
     volumes:
       - ./livekit.yaml:/etc/livekit.yaml:ro
       - ./certs:/etc/voice/certs
diff --git a/supervisord.conf b/supervisord.conf
index 4336f14..b9fe1d8 100644
--- a/supervisord.conf
+++ b/supervisord.conf
@@ -60,6 +60,10 @@ environment=
 [program:media-server]
 ; Runs as root because the /data/media bind mount is a host (Unraid) share
 ; whose uid does not match the container's voiceuser.
+; MEDIA_DIR / MEDIA_SERVER_PORT / YTDLP_COOKIES are inherited from the
+; container environment (media_server.py has safe defaults for all three) —
+; do NOT list them via %(ENV_x)s here: a missing var aborts supervisord's
+; config expansion and takes every program down with it.
 command=/opt/voice-agent/.venv/bin/python /opt/voice/media_server.py
 user=root
 autostart=true
@@ -67,7 +71,3 @@ autorestart=true
 stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 redirect_stderr=true
-environment=
-    MEDIA_DIR="%(ENV_MEDIA_DIR)s",
-    MEDIA_SERVER_PORT="%(ENV_MEDIA_SERVER_PORT)s",
-    YTDLP_COOKIES="%(ENV_YTDLP_COOKIES)s"