diff --git a/services/shared/nest.sh b/services/shared/nest.sh
index cf7f7bd..fe844eb 100644
--- a/services/shared/nest.sh
+++ b/services/shared/nest.sh
@@ -96,17 +96,26 @@ EOF
     src/health/health.controller.ts || return 1
   rm -f src/health/health.controller.ts.bak
 
-  grep -q "dbClient" src/health/health.controller.ts \
-    && grep -q "PrismaClient" src/health/health.controller.ts \
-    && grep -q "return { status: 'ok' };" src/health/health.controller.ts \
-    && grep -q "async ready(): Promise<" src/health/health.controller.ts \
-    || die "could not splice the database probe into src/health/health.controller.ts — has the anchor moved?"
+  assert_nest_probe_spliced src/health/health.controller.ts
 
   # The mongodb and SQL branches wrap differently under prettier's print width,
   # so reformat once rather than hand-matching its output per branch.
   pnpm exec prettier --write src/health/health.controller.ts || return 1
 }
 
+# The fourth check is the absence of the fallback throw, not the presence of the
+# success return: live() already returns `{ status: 'ok' };`, so a grep for that
+# matches the shipped file and passes whether or not the splice landed.
+assert_nest_probe_spliced() {
+  local -r file="$1"
+
+  grep -q "dbClient" "$file" \
+    && grep -q "PrismaClient" "$file" \
+    && grep -q "async ready(): Promise<" "$file" \
+    && ! grep -q "no database is configured for this project" "$file" \
+    || die "could not splice the database probe into ${file} — has the anchor moved?"
+}
+
 service_driver_dockerfile() {
   printf 'RUN pnpm exec prisma generate\n'
 }
diff --git a/tests/service.bats b/tests/service.bats
index 9fa8882..d0fa0cf 100644
--- a/tests/service.bats
+++ b/tests/service.bats
@@ -151,6 +151,28 @@ setup() {
   done
 }
 
+@test "the nest probe guard rejects a controller whose fallback throw survived" {
+  # The guard used to check for `return { status: 'ok' };`, which live() already
+  # returns — so a controller with three splices applied and the fourth missed
+  # passed it, and the project shipped a readiness route that was permanently
+  # 503 with nothing said about it.
+  source "${SCAFFOLD_ROOT}/services/shared/nest.sh"
+
+  local file="${BATS_TEST_TMPDIR}/health.controller.ts"
+  cp "${SCAFFOLD_ROOT}/adapters/nestjs/src/health/health.controller.ts" "$file"
+  sed -i 's|// @DB_CLIENT@|private dbClient?: { $queryRawUnsafe(q: string): Promise<unknown> };|' "$file"
+  sed -i 's|// @DB_PROBE@|this.dbClient = new PrismaClient();|' "$file"
+  sed -i 's|  ready(): Promise<|  async ready(): Promise<|' "$file"
+
+  run assert_nest_probe_spliced "$file"
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"has the anchor moved?"* ]]
+
+  sed -i "s|throw new Error('no database is configured for this project');|return { status: 'ok' };|" "$file"
+  run assert_nest_probe_spliced "$file"
+  assert_ok
+}
+
 @test "apply_service_dockerfile removes the anchor when nothing was selected" {
   local app="${BATS_TEST_TMPDIR}/app"
   mkdir -p "$app"