diff --git a/assets/acls/default.toml b/assets/acls/default.toml
index e34e7931..92b2e6d0 100644
--- a/assets/acls/default.toml
+++ b/assets/acls/default.toml
@@ -84,6 +84,12 @@ allow = true
 privileges = ["POST"]
 identity.Group = "kumomta:http-listener-trusted-ip"
 
+# Explicitly allow blanket unauthenticated access to the health status endpoint
+[[acl."http_listener/*/tsa/status"]]
+allow = true
+privileges = ["GET"]
+identity.Any = {}
+
 ### TSA config access -----------------------------
 [[acl."http_listener/*/get_config_v1"]]
 allow = true
diff --git a/crates/integration-tests/src/test/http_liveness.rs b/crates/integration-tests/src/test/http_liveness.rs
new file mode 100644
index 00000000..5efd7415
--- /dev/null
+++ b/crates/integration-tests/src/test/http_liveness.rs
@@ -0,0 +1,56 @@
+use crate::kumod::{DaemonWithMaildir, DaemonWithTsa};
+use anyhow::Context;
+
+#[tokio::test]
+async fn http_liveness_kumod() -> anyhow::Result<()> {
+    let mut daemon = DaemonWithMaildir::start().await?;
+
+    let client = reqwest::Client::new();
+    let response = client
+        .get(&format!(
+            "http://{}/api/check-liveness/v1",
+            daemon.sink.listener("http")
+        ))
+        .send()
+        .await?;
+
+    let status = response.status();
+
+    let body_bytes = response
+        .text()
+        .await
+        .context("failed to read error response body")?;
+
+    k9::assert_equal!(format!("{status} {body_bytes}"), "200 OK OK");
+
+    daemon.stop_both().await?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn http_liveness_tsa() -> anyhow::Result<()> {
+    let mut daemon = DaemonWithTsa::start().await?;
+
+    let client = reqwest::Client::new();
+    let response = client
+        .get(&format!(
+            "http://{}/tsa/status",
+            daemon.tsa.listener("http")
+        ))
+        .send()
+        .await?;
+
+    let status = response.status();
+
+    let body_bytes = response
+        .text()
+        .await
+        .context("failed to read error response body")?;
+
+    k9::assert_equal!(format!("{status} {body_bytes}"), "200 OK TSA Daemon OK");
+
+    daemon.stop().await?;
+
+    Ok(())
+}
diff --git a/crates/integration-tests/src/test/mod.rs b/crates/integration-tests/src/test/mod.rs
index 356368c0..d4ba205f 100644
--- a/crates/integration-tests/src/test/mod.rs
+++ b/crates/integration-tests/src/test/mod.rs
@@ -20,6 +20,7 @@ mod http_inject_compression;
 mod http_inject_deferred;
 mod http_inject_size_limit;
 mod http_inject_template_syntax_error;
+mod http_liveness;
 mod log_oob_arf;
 mod maildir_batch;
 mod maildir_batch_452;