diff --git a/bin/healthcheck.sh b/bin/healthcheck.sh
new file mode 100644
index 0000000..cbca83e
--- /dev/null
+++ b/bin/healthcheck.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# Exit 0 if the relay answers, non-zero otherwise. For the on-call check.
+set -eu
+. "$(dirname "$0")/../.env"
+code=$(curl -ks -o /dev/null -w '%{http_code}' --max-time 5 \
+  -H "Authorization: Bearer ${RELAY_TOKEN}" "${RELAY_ENDPOINT}/healthz" || echo 000)
+[ "$code" = "200" ] || { echo "relay unhealthy: $code" >&2; exit 1; }