diff --git a/docker-compose.yml b/docker-compose.yml
index eb15ee2..2205f17 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -199,6 +199,16 @@ services:
   psql-app:
     restart: unless-stopped
     container_name: obmp-psql-app
+    # Gate startup on Postgres being ready. psql-app's consumer connects to
+    # Postgres once at startup and, if it loses the cold-boot race (DB still
+    # initialising -> "the database system is starting up"), ConsumerApp.main
+    # throws and the consumer dies -- and the container does NOT exit, so
+    # restart: unless-stopped never fires. service_healthy avoids the race.
+    depends_on:
+      psql:
+        condition: service_healthy
+      kafka:
+        condition: service_started
     # No healthcheck — the consumer exposes no health port; Docker's
     # restart-on-exit covers process death.
     image: openbmp/psql-app:2.2.2