diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8c81d4c..fd04d89 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,3 +24,8 @@ jobs:
         run: lsmod | grep riptides
       - name: Verify daemon is running
         run: systemctl is-active riptides
+      - name: Verify daemon is ready
+        run: |
+          health=$(cat /sys/module/riptides/health)
+          echo "driver health: $health"
+          [[ "$health" == OK* ]]
diff --git a/README.md b/README.md
index e7e91dc..80d4d7b 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,8 @@ Riptides injects the bearer token for outbound calls to services in your policy,
 | `controlplane-url` | yes | | URL of your Riptides control plane |
 | `audience` | no | `riptides` | OIDC token audience, must match `GitHubActionsVerifier` config |
 | `version` | no | `latest` | Daemon version to install |
+| `wait-for-ready` | no | `true` | Wait for the daemon to be fully ready before the step finishes |
+| `ready-timeout` | no | `120` | Seconds to wait for readiness |
 
 ## How it works
 
@@ -80,5 +82,8 @@ The action calls the Riptides [install.sh](https://docs.riptides.io/install.sh)
 1. Installs the kernel driver and daemon package
 2. Calls `riptides daemon auth --plugin GitHubActions`, fetches an OIDC token from the Actions token endpoint and exchanges it for a SPIFFE x509 identity certificate
 3. Starts the daemon as a systemd service
+4. Waits until the driver reports the daemon fully ready — connected, trust anchors loaded, workload identity issued (`--wait-ready`)
+
+Step 4 matters because the daemon needs a moment after the service starts before traffic is actually intercepted. Without it, a step running immediately after this action can open connections that are missed. Set `wait-for-ready: false` to skip the wait.
 
 The runner VM is ephemeral so no cleanup step is needed.
diff --git a/action.yml b/action.yml
index d5321da..4bec73a 100644
--- a/action.yml
+++ b/action.yml
@@ -13,6 +13,14 @@ inputs:
     description: "Daemon version to install (default: latest)"
     required: false
     default: latest
+  wait-for-ready:
+    description: Wait for the daemon to be fully ready (driver connected, workload identity issued) before finishing, so connections made by the next step are not missed
+    required: false
+    default: "true"
+  ready-timeout:
+    description: How long to wait, in seconds, for the daemon to become ready
+    required: false
+    default: "120"
 
 branding:
   icon: shield
@@ -26,7 +34,13 @@ runs:
       env:
         DAEMON_VERSION: ${{ inputs.version }}
       run: |
+        wait_args=()
+        if [[ "${{ inputs.wait-for-ready }}" == "true" ]]; then
+          wait_args=(--wait-ready --wait-timeout "${{ inputs.ready-timeout }}")
+        fi
+
         curl -fsSL https://docs.riptides.io/install.sh | sudo -E bash -s -- \
           --controlplane-url "${{ inputs.controlplane-url }}" \
           --plugin GitHubActions \
-          --github-actions-audience "${{ inputs.audience }}"
+          --github-actions-audience "${{ inputs.audience }}" \
+          "${wait_args[@]}"