diff --git a/src/daemon/admin/index.ts b/src/daemon/admin/index.ts
index 3940327..db8733b 100644
--- a/src/daemon/admin/index.ts
+++ b/src/daemon/admin/index.ts
@@ -168,12 +168,17 @@ class AdminInterface {
                 this.handleRequest(req);
             });
 
-            // pingOrDie disabled — NDK 2.8.1 outbox model doesn't echo
-            // self-published events back through subscriptions on
-            // non-public relay channels, so the watchdog fires false
-            // positives and exits the bunker every 50s on private relays.
-            // See aiolabs/nsecbunkerd#4 + #7.
-            // pingOrDie(this.ndk);
+            // Connection watchdog: exit if pool reports no connected relays
+            // for >60s so the process supervisor (systemd / docker restart
+            // policy / k8s) can recover. Replaces the original self-echo
+            // pingOrDie — see relayConnectionWatchdog comment + #4 + #7.
+            // Operators with external liveness checking can disable via
+            // NSEC_BUNKER_DISABLE_WATCHDOG=1.
+            if (process.env.NSEC_BUNKER_DISABLE_WATCHDOG !== '1') {
+                relayConnectionWatchdog(this.ndk);
+            } else {
+                console.log('⏸  watchdog disabled via NSEC_BUNKER_DISABLE_WATCHDOG=1');
+            }
         }).catch((err) => {
             console.log('❌ admin connection failed');
             console.log(err);