diff --git a/k8s-ng/core/secret-stores/bitwarden-cli.yaml b/k8s-ng/core/secret-stores/bitwarden-cli.yaml
index 9a07094..7194ad3 100644
--- a/k8s-ng/core/secret-stores/bitwarden-cli.yaml
+++ b/k8s-ng/core/secret-stores/bitwarden-cli.yaml
@@ -62,15 +62,19 @@ spec:
               containerPort: 8087
               protocol: TCP
           livenessProbe:
+            # Syncs the vault and requires the bridge to be logged in: `bw serve` can
+            # lose its login (status "unauthenticated") while /sync still answers, and
+            # every lookup then fails with 500. Failing the probe restarts the pod.
             exec:
               command:
-                - wget
-                - -q
-                - http://127.0.0.1:8087/sync
-                - --post-data=''
+                - sh
+                - -c
+                - >-
+                  wget -q -O /dev/null --post-data='' http://127.0.0.1:8087/sync &&
+                  wget -q -O - http://127.0.0.1:8087/status | grep -q '"status":"unlocked"'
             initialDelaySeconds: 20
             failureThreshold: 3
-            timeoutSeconds: 1
+            timeoutSeconds: 10
             periodSeconds: 120
           readinessProbe:
             tcpSocket: