diff --git a/install-graylog.sh b/install-graylog.sh
index 4c556ae..c30a016 100644
--- a/install-graylog.sh
+++ b/install-graylog.sh
@@ -208,6 +208,24 @@ gcurl() {
   fi
 }
 
+wait_for_api_ready() {
+  # Docker's healthcheck can report the container "healthy" a few seconds
+  # before Graylog's REST API is actually ready to serve authenticated
+  # requests (indices/auth subsystems still initializing) - confirmed live:
+  # the very first gcurl call (step_index_retention) intermittently got an
+  # empty response, which then crashed the downstream `python3 -c
+  # "json.load(sys.stdin)"` with "Expecting value: line 1 column 1".
+  log "Waiting for the Graylog REST API to accept authenticated requests..."
+  local waited=0
+  while true; do
+    gcurl GET /system/indices/index_sets | python3 -c "import json,sys;json.load(sys.stdin)" 2>/dev/null && break
+    waited=$((waited + 3))
+    [ "$waited" -ge 60 ] && die "Graylog REST API did not respond with valid JSON within 60s of the container reporting healthy."
+    sleep 3
+  done
+  ok "Graylog REST API is ready"
+}
+
 step_index_retention() {
   # Graylog's factory default (as of 7.1) keeps 30-40 days of data across up
   # to 20 indices - reasonable in general, but risky on a small disk (this
@@ -484,6 +502,7 @@ main() {
   # aborts the script - gcurl() is always called from inside command
   # substitutions downstream, where `die`'s `exit` would only kill a subshell.
   resolve_admin_password
+  wait_for_api_ready
 
   step_index_retention
   step_inputs