diff --git a/config/default.yaml b/config/default.yaml
index 88c91ca..a49540b 100644
--- a/config/default.yaml
+++ b/config/default.yaml
@@ -87,7 +87,7 @@ server:
   # gateway to your tailnet via `tailscale serve`.
   tailscale:
     serve: false
-  localhost: true
+  localhost: false
   port: 18800
   # Maximum inbound HTTP request body size (bytes) for webhooks/Gmail push.
   max_request_body_bytes: 1048576
diff --git a/src/cli/setup/config.ts b/src/cli/setup/config.ts
index 3006749..434936c 100644
--- a/src/cli/setup/config.ts
+++ b/src/cli/setup/config.ts
@@ -86,7 +86,7 @@ export class ConfigBuilder {
     this.config = {
       log_level: 'info',
       models: {},
-      server: { port: 18800, localhost: true },
+      server: { port: 18800, localhost: false },
       hooks: {
         confirm: [
           'shell.*',
diff --git a/src/config/schema.ts b/src/config/schema.ts
index 3c36383..a02c671 100644
--- a/src/config/schema.ts
+++ b/src/config/schema.ts
@@ -109,7 +109,7 @@ const serverNodePolicySchema = z.object({
 
 const serverSchema = z.object({
   tailscale: tailscaleSchema,
-  localhost: z.boolean().default(true),
+  localhost: z.boolean().default(false),
   port: z.number().default(18800),
   /** Static bearer token for gateway auth. If set, all connections must provide it. */
   token: z.string().optional(),