diff --git a/mcp/server.py b/mcp/server.py
index 10ff341..59c1bfa 100755
--- a/mcp/server.py
+++ b/mcp/server.py
@@ -37,6 +37,10 @@ SSH_TIMEOUT = int(os.environ.get("HOMELAB_MCP_SSH_TIMEOUT", "10"))
 mcp = FastMCP("homelab")
 mcp.settings.host = os.environ.get("HOMELAB_MCP_HOST", "0.0.0.0")
 mcp.settings.port = int(os.environ.get("HOMELAB_MCP_PORT", "9810"))
+# FastMCP's DNS-rebinding protection only whitelists 127.0.0.1 / localhost / [::1]
+# by default, which breaks any LAN/mesh client. We're already mesh+LAN-gated at
+# nftables and the browser-attack threat doesn't apply to mesh-only services.
+mcp.settings.transport_security.enable_dns_rebinding_protection = False
 
 
 def _load_inventory() -> dict: