diff --git a/nix/modules/bridge.nix b/nix/modules/bridge.nix
index f6057b3..991e7c2 100644
--- a/nix/modules/bridge.nix
+++ b/nix/modules/bridge.nix
@@ -40,7 +40,7 @@ let
           # admin-registered push optimization deduped against the poller (§4.1). Enrollment = add
           # the repo to POLL_REPOS (csv) + ensure tests/<recipe>/ exists.
           - POLL_INTERVAL=30
-          - POLL_REPOS=recipe-maintainers/cc-ci,recipe-maintainers/custom-html,recipe-maintainers/keycloak,recipe-maintainers/cryptpad,recipe-maintainers/matrix-synapse,recipe-maintainers/lasuite-docs,recipe-maintainers/n8n
+          - POLL_REPOS=recipe-maintainers/cc-ci,recipe-maintainers/custom-html,recipe-maintainers/keycloak,recipe-maintainers/cryptpad,recipe-maintainers/matrix-synapse,recipe-maintainers/lasuite-docs,recipe-maintainers/n8n,recipe-maintainers/hedgedoc
           - HMAC_FILE=/run/secrets/webhook_hmac
           - DRONE_TOKEN_FILE=/run/secrets/drone_token
           - GITEA_TOKEN_FILE=/run/secrets/gitea_token
diff --git a/tests/keycloak/test_backup.py b/tests/keycloak/test_backup.py
index e68b84d..6d182be 100644
--- a/tests/keycloak/test_backup.py
+++ b/tests/keycloak/test_backup.py
@@ -22,6 +22,11 @@ def test_backup_captures_state(live_app, meta):
     snap = generic.do_backup(domain)
     assert snap, "backup produced no snapshot artifact"
 
+    # backup-bot-two cycles the keycloak container during backup, so the admin API is briefly 502.
+    # Wait for it to be serving again, then re-auth, before mutating via the HTTP admin API.
+    generic.assert_serving(domain, meta)
+    tok = kc_admin.admin_token(domain, pw)
+
     # 2) mutate: delete the realm (diverge from the backup)
     assert kc_admin.delete_marker_realm(domain, tok) in (204, 200)
     assert not kc_admin.marker_realm_exists(domain, tok), "delete did not take"