diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4534b2e..0405bd2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -158,8 +158,11 @@ jobs:
           port_suffix="$(( ${GITHUB_RUN_ID:-$$} % 10000 ))"
           export RENDEZVOUS_HTTP_HOST_PORT="$(( 20000 + port_suffix ))"
           export RENDEZVOUS_UDP_HOST_PORT="$(( 40000 + port_suffix ))"
-          export RENDEZVOUS_SMOKE_HTTP_URL="http://127.0.0.1:${RENDEZVOUS_HTTP_HOST_PORT}/"
-          export RENDEZVOUS_SMOKE_UDP_ENDPOINT="127.0.0.1:${RENDEZVOUS_UDP_HOST_PORT}"
+          export RENDEZVOUS_HTTP_BIND_ADDRESS="0.0.0.0"
+          runner_host_gateway="$(docker inspect "$HOSTNAME" | jq -er \
+            '.[0].NetworkSettings.Networks | to_entries[0].value.Gateway')"
+          export RENDEZVOUS_SMOKE_HTTP_URL="http://${runner_host_gateway}:${RENDEZVOUS_HTTP_HOST_PORT}/"
+          export RENDEZVOUS_SMOKE_UDP_ENDPOINT="${runner_host_gateway}:${RENDEZVOUS_UDP_HOST_PORT}"
           runner_workspace_source="$(docker inspect "$HOSTNAME" | jq -er \
             --arg destination "$GITHUB_WORKSPACE" \
             '.[0].Mounts[] | select(.Destination == $destination) | .Source')"
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 44458e6..83ed4d3 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -126,8 +126,11 @@ jobs:
           port_suffix="$(( ${GITHUB_RUN_ID:-$$} % 10000 ))"
           export RENDEZVOUS_HTTP_HOST_PORT="$(( 20000 + port_suffix ))"
           export RENDEZVOUS_UDP_HOST_PORT="$(( 40000 + port_suffix ))"
-          export RENDEZVOUS_SMOKE_HTTP_URL="http://127.0.0.1:${RENDEZVOUS_HTTP_HOST_PORT}/"
-          export RENDEZVOUS_SMOKE_UDP_ENDPOINT="127.0.0.1:${RENDEZVOUS_UDP_HOST_PORT}"
+          export RENDEZVOUS_HTTP_BIND_ADDRESS="0.0.0.0"
+          runner_host_gateway="$(docker inspect "$HOSTNAME" | jq -er \
+            '.[0].NetworkSettings.Networks | to_entries[0].value.Gateway')"
+          export RENDEZVOUS_SMOKE_HTTP_URL="http://${runner_host_gateway}:${RENDEZVOUS_HTTP_HOST_PORT}/"
+          export RENDEZVOUS_SMOKE_UDP_ENDPOINT="${runner_host_gateway}:${RENDEZVOUS_UDP_HOST_PORT}"
           runner_workspace_source="$(docker inspect "$HOSTNAME" | jq -er \
             --arg destination "$GITHUB_WORKSPACE" \
             '.[0].Mounts[] | select(.Destination == $destination) | .Source')"
diff --git a/deploy/compose/compose.yaml b/deploy/compose/compose.yaml
index df98ae1..e216da5 100644
--- a/deploy/compose/compose.yaml
+++ b/deploy/compose/compose.yaml
@@ -33,5 +33,5 @@ services:
       - ${RENDEZVOUS_CONFIG_SOURCE:-./appsettings.Production.json}:/app/appsettings.Production.json:ro
       - ${RENDEZVOUS_SECRET_SOURCE:-./secrets/signing-key}:/run/secrets/rendezvous-signing-key:ro
     ports:
-      - "127.0.0.1:${RENDEZVOUS_HTTP_HOST_PORT:-8080}:8080/tcp"
+      - "${RENDEZVOUS_HTTP_BIND_ADDRESS:-127.0.0.1}:${RENDEZVOUS_HTTP_HOST_PORT:-8080}:8080/tcp"
       - "${RENDEZVOUS_UDP_HOST_PORT:-9050}:9050/udp"
diff --git a/docs/deployment/linux.md b/docs/deployment/linux.md
index 8dd6ffc..76f3c20 100644
--- a/docs/deployment/linux.md
+++ b/docs/deployment/linux.md
@@ -49,7 +49,9 @@ Compose, then point `RENDEZVOUS_SMOKE_HTTP_URL` and
 and production-advertised service ports remain 8080/9050. Sibling-container CI
 runners may also set `RENDEZVOUS_CONFIG_SOURCE` and
 `RENDEZVOUS_SECRET_SOURCE` to host-visible absolute bind-source paths; local
-operators should normally keep the checked-in relative defaults.
+operators should normally keep the checked-in relative defaults. Those runners
+may set `RENDEZVOUS_HTTP_BIND_ADDRESS=0.0.0.0` and target their Docker host
+gateway; do not widen the default loopback HTTP binding on an ordinary host.
 
 `deploy/compose/appsettings.Production.json` is a local/private-bridge smoke
 profile, not an Internet template: TCP is published only on host loopback, the
diff --git a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
index fa790c3..9194fd7 100644
--- a/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
+++ b/tests/FinalFactory.Rendezvous.Tests/Release/ReleaseCompatibilityTests.cs
@@ -169,6 +169,7 @@ public sealed class ReleaseCompatibilityTests
     {
         string root = FindRepositoryRoot();
         string compose = File.ReadAllText(Path.Combine(root, "deploy/compose/compose.yaml"));
+        Assert.Contains("${RENDEZVOUS_HTTP_BIND_ADDRESS:-127.0.0.1}", compose, StringComparison.Ordinal);
         Assert.Contains("${RENDEZVOUS_HTTP_HOST_PORT:-8080}:8080/tcp", compose, StringComparison.Ordinal);
         Assert.Contains("${RENDEZVOUS_UDP_HOST_PORT:-9050}:9050/udp", compose, StringComparison.Ordinal);
         Assert.Contains("${RENDEZVOUS_CONFIG_SOURCE:-./appsettings.Production.json}", compose, StringComparison.Ordinal);
@@ -178,6 +179,8 @@ public sealed class ReleaseCompatibilityTests
         {
             string workflow = File.ReadAllText(Path.Combine(root, ".gitea/workflows", workflowName));
             Assert.Contains("GITHUB_RUN_ID", workflow, StringComparison.Ordinal);
+            Assert.Contains("runner_host_gateway", workflow, StringComparison.Ordinal);
+            Assert.Contains("RENDEZVOUS_HTTP_BIND_ADDRESS", workflow, StringComparison.Ordinal);
             Assert.Contains("RENDEZVOUS_HTTP_HOST_PORT", workflow, StringComparison.Ordinal);
             Assert.Contains("RENDEZVOUS_UDP_HOST_PORT", workflow, StringComparison.Ordinal);
             Assert.Contains("RENDEZVOUS_SMOKE_HTTP_URL", workflow, StringComparison.Ordinal);