diff --git a/main.py b/main.py
index 8b23f2b..c576f95 100644
--- a/main.py
+++ b/main.py
@@ -51,8 +51,14 @@ app = FastAPI(
     version="0.1.0",
 )
 
+# Paths exempt from IAP enforcement (health/readiness probes reach Cloud Run
+# directly without the IAP-injected x-goog-authenticated-user-email header).
+IAP_EXEMPT_PATHS = {"/health", "/healthz", "/readiness", "/liveness"}
+
 @app.middleware("http")
 async def require_iap(request: Request, call_next):
+    if request.url.path in IAP_EXEMPT_PATHS:
+        return await call_next(request)
     if not request.headers.get("x-goog-authenticated-user-email"):
         return Response(status_code=401, content="Unauthorized")
     return await call_next(request)