diff --git a/scripts/health.sh b/scripts/health.sh
index 40db2fb..f4ec71e 100755
--- a/scripts/health.sh
+++ b/scripts/health.sh
@@ -1,12 +1,16 @@
 #!/usr/bin/env bash
-# Health of the deployed pieces: the site, the API through Caddy, and the
-# containers on the api host. The container check needs AWS credentials and
-# tofu; everything else is plain HTTP.
+# Health of the deployed pieces: the site, and the API through Caddy. Plain
+# HTTP and no credentials, so this runs anywhere.
+#
+# It used to also ask the api host over SSM whether its containers were up.
+# That answered nothing the HTTP checks do not - /healthz only returns ok if
+# the api container is serving, and the redirect only happens if Caddy is -
+# while needing AWS credentials, tofu, and an `aws ssm send-command` that is
+# broken on at least one machine here.
 set -uo pipefail
 
 # No set -e: every check runs, failures are counted, the exit code reports.
 
-ENV_DIR="$(dirname "$0")/../envs/lance.blue"
 failures=0
 
 check() { # name expected actual
@@ -42,21 +46,4 @@ check "api /healthz" ok "$healthz"
 redirect=$(curl -s -m 10 -o /dev/null -w '%{http_code}' http://api.lance.blue/healthz || echo unreachable)
 check "caddy http->https redirect" 308 "$redirect"
 
-instance=$(tofu -chdir="$ENV_DIR" output -raw api_instance_id 2>/dev/null || true)
-if [ -z "$instance" ]; then
-  echo "SKIP  containers: cannot read api_instance_id (AWS credentials?)"
-else
-  cmd_id=$(aws ssm send-command --instance-ids "$instance" \
-    --document-name AWS-RunShellScript \
-    --parameters 'commands=["docker inspect -f {{.State.Status}} api","docker inspect -f {{.State.Status}} caddy","docker ps"]' \
-    --query Command.CommandId --output text)
-  sleep 3
-  out=$(aws ssm get-command-invocation --command-id "$cmd_id" \
-    --instance-id "$instance" --query StandardOutputContent --output text)
-  check "container api" running "$(echo "$out" | sed -n 1p)"
-  check "container caddy" running "$(echo "$out" | sed -n 2p)"
-  echo
-  echo "$out" | tail -n +3
-fi
-
 [ "$failures" -eq 0 ]