diff --git a/scripts/orchestra_e2e_healthcheck.sh b/scripts/orchestra_e2e_healthcheck.sh
index cfc8c5b..284fb27 100755
--- a/scripts/orchestra_e2e_healthcheck.sh
+++ b/scripts/orchestra_e2e_healthcheck.sh
@@ -27,15 +27,18 @@ main() {
   local summary=
   local -a results=()
   local timing=
+  local strict=
+  local unknown=
   for arg in "$@"; do
     if [ "$arg" = --help ]; then
-      emit text 'Usage: %s [--quiet] [--json] [--summary] [--timing] [--list-checks]\n\n' "${0##*/}"
+      emit text 'Usage: %s [--quiet] [--json] [--summary] [--timing] [--strict] [--list-checks]\n\n' "${0##*/}"
       emit text 'Healthcheck script for Orchestra E2E tests.\n'
       emit text 'Exits 0 with a success message if all checks pass.\n'
       emit text '  --quiet  Suppress the success message; still exits 0.\n'
       emit text '  --list-checks  Print the name of each check; exits 0.\n'
       emit text '  --summary  Print one line per check before the success message.\n'
       emit text '  --timing Print elapsed milliseconds for each check.\n'
+      emit text '  --strict Reject an unrecognised flag: exits 2.\n'
       emit text 'Version: %s\n' "$VERSION"
       exit 0
     elif [ "$arg" = --list-checks ]; then
@@ -51,9 +54,18 @@ main() {
       summary=1
     elif [ "$arg" = --timing ]; then
       timing=1
+    elif [ "$arg" = --strict ]; then
+      strict=1
+    else
+      [ -n "$unknown" ] || unknown=$arg
     fi
   done
 
+  if [ -n "$strict" ] && [ -n "$unknown" ]; then
+    printf 'unknown flag: %s\n' "$unknown" >&2
+    exit 2
+  fi
+
   results+=("healthcheck ok")
 
   local format=text
diff --git a/scripts/orchestra_e2e_selftest.sh b/scripts/orchestra_e2e_selftest.sh
index f99d410..dedf463 100755
--- a/scripts/orchestra_e2e_selftest.sh
+++ b/scripts/orchestra_e2e_selftest.sh
@@ -34,4 +34,16 @@ case "$jout" in
   *) fail '--json run stdout prefix: want {"status":' "$jout" ;;
 esac
 
+# --strict rejects an unknown flag
+sout=$(bash "$healthcheck" --strict --nonsense 2>&1)
+sstatus=$?
+
+[ "$sstatus" -eq 2 ] || fail "--strict --nonsense exit status: want 2, got $sstatus" "$sout"
+
+# --strict alone is accepted
+gout=$(bash "$healthcheck" --strict)
+gstatus=$?
+
+[ "$gstatus" -eq 0 ] || fail "--strict run exit status: want 0, got $gstatus" "$gout"
+
 printf 'selftest: ok\n'
diff --git a/scripts/test_healthcheck.sh b/scripts/test_healthcheck.sh
index 1ef6b32..170d8d2 100755
--- a/scripts/test_healthcheck.sh
+++ b/scripts/test_healthcheck.sh
@@ -3,7 +3,7 @@
 
 HC="$(dirname "$0")/orchestra_e2e_healthcheck.sh"
 OK='OK - all healthchecks passed'
-USAGE="$(printf 'Usage: orchestra_e2e_healthcheck.sh [--quiet] [--json] [--summary] [--timing] [--list-checks]\n\nHealthcheck script for Orchestra E2E tests.\nExits 0 with a success message if all checks pass.\n  --quiet  Suppress the success message; still exits 0.\n  --list-checks  Print the name of each check; exits 0.\n  --summary  Print one line per check before the success message.\n  --timing Print elapsed milliseconds for each check.\nVersion: 1.0.0')"
+USAGE="$(printf 'Usage: orchestra_e2e_healthcheck.sh [--quiet] [--json] [--summary] [--timing] [--strict] [--list-checks]\n\nHealthcheck script for Orchestra E2E tests.\nExits 0 with a success message if all checks pass.\n  --quiet  Suppress the success message; still exits 0.\n  --list-checks  Print the name of each check; exits 0.\n  --summary  Print one line per check before the success message.\n  --timing Print elapsed milliseconds for each check.\n  --strict Reject an unrecognised flag: exits 2.\nVersion: 1.0.0')"
 fails=0
 
 check() { # check <expected-stdout> <label> [args...]