As states increasingly use algorithms to improve the legibility of society, particularly during the COVID-19 pandemic, it is common for concerns about the expanding power of the algorithm or the state to be raised in a deterministic manner. However, how are the algorithms for states’ legibility projects enacted, contested, and reconfigured? Drawing on interviews and media data, this study fills this gap by examining Health Code ( jiankangma), the Chinese contact tracing and risk assessment algorithmic system that serves as the COVID-19 health passport. I first explore the intensive and invisible work and infrastructures that enact and stabilize Health Code’s sociotechnical assemblage. I then show how this assemblage is frequently challenged and destabilized by errors, breakdowns, and exclusions. Facing unintended engagements from heterogeneous social actors, local interests, and power hierarchies, Health Code reassembles into multiple and contradictory assemblages at different periods and social localities. Finally, I examine how people game and bypass the algorithm’s surveillance with their agencies. Recognizing this messiness and heterogeneity contributes to a more nuanced and realistic understanding of states’ use of algorithms, including the risks. Doing so also urges us to rethink the politics of citizenship and inequality in the digital age beyond inclusion.