diff --git a/CHANGELOG.md b/CHANGELOG.md
index 10f1c2df..e7e2e8df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 22.0-SNAPSHOT
+
+### ⚙️ Technical
+
+* Exposed `/xh/ping` as whitelisted route for basic uptime/reachability checks. Retained legacy
+  `/ping` alias, but prefer this new path going forward.
+
 ## 21.0.1 - 2024-09-05
 
 ### 🐞 Bug Fixes
diff --git a/grails-app/controllers/io/xh/hoist/UrlMappings.groovy b/grails-app/controllers/io/xh/hoist/UrlMappings.groovy
index 1d302495..46b4b639 100644
--- a/grails-app/controllers/io/xh/hoist/UrlMappings.groovy
+++ b/grails-app/controllers/io/xh/hoist/UrlMappings.groovy
@@ -18,7 +18,9 @@ class UrlMappings {
         "/$controller/$action?/$id?(.$format)?"{}
 
         "404" (controller: 'xh', action: 'notFound')
-        "/ping" (controller: 'xh', action: 'version')
+
+        // Legacy alias for /xh/ping
+        "/ping" (controller: 'xh', action: 'ping')
 
         //------------------------
         // Rest Support
diff --git a/grails-app/controllers/io/xh/hoist/impl/XhController.groovy b/grails-app/controllers/io/xh/hoist/impl/XhController.groovy
index d55c33db..ffbb70c0 100644
--- a/grails-app/controllers/io/xh/hoist/impl/XhController.groovy
+++ b/grails-app/controllers/io/xh/hoist/impl/XhController.groovy
@@ -275,17 +275,26 @@ class XhController extends BaseController {
     //-----------------------
     // Misc
     //-----------------------
+    /**
+     * Whitelisted (pre-auth) endpoint with minimal app identifier, for uptime/reachability checks.
+     * Also reachable via legacy `/ping` alias (via `UrlMappings`), but prefer `/xh/ping`.
+     */
+    def ping() {
+        renderJSON(
+            appCode: Utils.appCode,
+            timestamp: System.currentTimeMillis(),
+            success: true
+        )
+    }
+
     /**
      * Whitelisted (pre-auth) endpoint with minimal app identifier and version info.
-     * Also reachable (for backwards compatibility) via /ping, as per `UrlMappings`.
      */
     def version() {
         renderJSON(
             appCode: Utils.appCode,
             appVersion: Utils.appVersion,
             appBuild: Utils.appBuild,
-            timestamp: System.currentTimeMillis(),
-            success: true,
             // TODO - this is a temporary measure to ensure that clients running hoist-react < 67
             //      prompt for upgrade when a new app release is deployed with hoist-core >= 21.
             //      Going forward clients will read these instructions from `xh/environmentPoll`.
diff --git a/src/main/groovy/io/xh/hoist/security/BaseAuthenticationService.groovy b/src/main/groovy/io/xh/hoist/security/BaseAuthenticationService.groovy
index 5849a299..0db054d6 100644
--- a/src/main/groovy/io/xh/hoist/security/BaseAuthenticationService.groovy
+++ b/src/main/groovy/io/xh/hoist/security/BaseAuthenticationService.groovy
@@ -147,9 +147,10 @@ abstract class BaseAuthenticationService extends BaseService {
      * session within their completeAuthentication() implementations.
      */
     protected List<String> whitelistURIs = [
-        '/ping',
+        '/ping',  // legacy alias for /xh/ping (via UrlMappings)
         '/xh/login',
         '/xh/logout',
+        '/xh/ping',
         '/xh/version',
         '/xh/authConfig'
     ]