diff --git a/roles/kibana/tasks/main.yml b/roles/kibana/tasks/main.yml
index ed56b57..4bcde49 100644
--- a/roles/kibana/tasks/main.yml
+++ b/roles/kibana/tasks/main.yml
@@ -145,10 +145,18 @@
   block:
     - name: Wait for Kibana readiness ({{ 'HTTPS' if kibana_tls | default(false) | bool else 'HTTP' }})
       ansible.builtin.shell:
+        # Exit codes:
+        #   0  ready (200 or 401)
+        #   1  transient — still starting up, keep retrying
+        #   2  permanent — service dead or a fatal log line already surfaced
         cmd: |
           if ! systemctl is-active --quiet kibana; then
             exit 2
           fi
+          if journalctl -u kibana --no-pager -n 100 --since '2 minutes ago' 2>/dev/null | \
+              grep -Eq 'FATAL|Unable to connect to Elasticsearch|Authentication.*failed|Kibana server is not ready.*fatal'; then
+            exit 2
+          fi
           HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' {{ 'https' if kibana_tls | default(false) | bool else 'http' }}://localhost:5601/api/status 2>/dev/null) || true
           if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "401" ]; then
             exit 0
diff --git a/roles/kibana/tasks/restart_and_verify_kibana.yml b/roles/kibana/tasks/restart_and_verify_kibana.yml
index 1bffc50..f8cedb9 100644
--- a/roles/kibana/tasks/restart_and_verify_kibana.yml
+++ b/roles/kibana/tasks/restart_and_verify_kibana.yml
@@ -23,7 +23,19 @@
 
     - name: restart_and_verify_kibana | Wait for Kibana readiness ({{ 'HTTPS' if kibana_tls | default(false) | bool else 'HTTP' }})
       ansible.builtin.shell:
+        # Exit codes:
+        #   0  ready (200 or 401)
+        #   1  transient — still starting up, keep retrying
+        #   2  permanent — service died or a fatal log line already surfaced,
+        #      no point in waiting the remaining retries
         cmd: |
+          if ! systemctl is-active --quiet kibana; then
+            exit 2
+          fi
+          if journalctl -u kibana --no-pager -n 100 --since '2 minutes ago' 2>/dev/null | \
+              grep -Eq 'FATAL|Unable to connect to Elasticsearch|Authentication.*failed|Kibana server is not ready.*fatal'; then
+            exit 2
+          fi
           HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' {{ 'https' if kibana_tls | default(false) | bool else 'http' }}://localhost:5601/api/status 2>/dev/null) || true
           if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "401" ]; then
             exit 0
@@ -34,6 +46,7 @@
       retries: 60
       delay: 5
       changed_when: false
+      failed_when: _kibana_http_check.rc == 2
 
   rescue:
     - name: restart_and_verify_kibana | Get recent Kibana journal output
@@ -45,7 +58,7 @@
     - name: restart_and_verify_kibana | Fail with Kibana startup diagnostics
       ansible.builtin.fail:
         msg: |
-          Kibana failed to start.
+          Kibana failed to start{% if _kibana_http_check.rc | default(0) == 2 %} (permanent error detected — see log){% else %} (HTTP did not become ready within 300s){% endif %}.
 
           Recent log output:
           {{ _kibana_journal.stdout }}