diff --git a/README.md b/README.md
index e25836f..87f24d4 100644
--- a/README.md
+++ b/README.md
@@ -32,6 +32,7 @@ npm run build
 | Variable | Default | Description |
 |---|---|---|
 | `PORT` | `3001` | Server listen port |
+| `HOST` | `127.0.0.1` | Server listen address. Use `0.0.0.0` only on a trusted network or behind authentication. |
 | `LITELLM_URL` | `http://192.168.50.240:4000` | LiteLLM API base URL |
 | `LITELLM_KEY` | *(from ~/.pi/agent)* | LiteLLM API key (auto-detected from Pi config if unset) |
 
@@ -47,7 +48,7 @@ Starts the server (`tsx watch`) on port 3001 and Vite dev server on port 5173 wi
 
 ```bash
 npm run build
-PORT=8085 npm start
+HOST=127.0.0.1 PORT=8085 npm start
 ```
 
 Or use the systemd user service:
diff --git a/docs/local-evaluation.md b/docs/local-evaluation.md
new file mode 100644
index 0000000..e9a0c7b
--- /dev/null
+++ b/docs/local-evaluation.md
@@ -0,0 +1,24 @@
+# Local evaluation on aiworker
+
+This fork is evaluated from `/root/projects/pi-webui` on the aiworker container.
+
+Because the app exposes a Pi coding-agent session with filesystem and shell tools, the local evaluation server is bound to loopback by default using `HOST=127.0.0.1`. Use an SSH tunnel to reach it from another machine instead of exposing it directly.
+
+## Commands used
+
+```bash
+npm ci --ignore-scripts
+npm run build
+HOST=127.0.0.1 PORT=3001 npm start
+```
+
+Health check:
+
+```bash
+curl -I http://127.0.0.1:3001/
+```
+
+## Repository remotes
+
+- `origin`: `ssh://git@git.openfu.com:11622/udo/pi-webui.git`
+- `upstream`: `https://github.com/Zetaphor/pi-webui.git`
diff --git a/server/index.ts b/server/index.ts
index 9af3983..8560c09 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -23,6 +23,7 @@ import type {
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PORT = parseInt(process.env.PORT || "3001");
+const HOST = process.env.HOST || "127.0.0.1";
 const LITELLM_URL = process.env.LITELLM_URL || "http://192.168.50.240:4000";
 let litellmKey = process.env.LITELLM_KEY || "";
 
@@ -383,8 +384,8 @@ async function main() {
     });
   });
 
-  server.listen(PORT, () => {
-    console.log(`Pi WebUI server listening on http://localhost:${PORT}`);
+  server.listen(PORT, HOST, () => {
+    console.log(`Pi WebUI server listening on http://${HOST}:${PORT}`);
   });
 }