diff --git a/backend/tests/test_compose_default_bind_host.py b/backend/tests/test_compose_default_bind_host.py
index 1064bb53a..705dc26ea 100644
--- a/backend/tests/test_compose_default_bind_host.py
+++ b/backend/tests/test_compose_default_bind_host.py
@@ -80,6 +80,14 @@ def test_bind_address_remains_overridable(variant: str):
     assert _bind_address(mapping) == "${BIND_HOST:-127.0.0.1}", f"{variant} compose must keep the bind address overridable via BIND_HOST; got: {mapping!r}"
 
 
+def test_dev_frontend_allows_default_loopback_origins():
+    """The Docker dev frontend must hydrate on its default published hosts."""
+    compose = yaml.safe_load(COMPOSE_PATHS["dev"].read_text(encoding="utf-8"))
+    environment = compose["services"]["frontend"]["environment"]
+
+    assert "DEER_FLOW_DEV_ALLOWED_ORIGINS=${DEER_FLOW_DEV_ALLOWED_ORIGINS:-127.0.0.1,::1}" in environment
+
+
 def _bind_address(mapping: str) -> str | None:
     """Return the bind-address segment of a compose port mapping, if any.
 
diff --git a/docker/docker-compose-dev.yaml b/docker/docker-compose-dev.yaml
index c4dfa801e..197d08967 100644
--- a/docker/docker-compose-dev.yaml
+++ b/docker/docker-compose-dev.yaml
@@ -138,6 +138,7 @@ services:
       - WATCHPACK_POLLING=true
       - CI=true
       - DEER_FLOW_INTERNAL_GATEWAY_BASE_URL=http://gateway:8001
+      - DEER_FLOW_DEV_ALLOWED_ORIGINS=${DEER_FLOW_DEV_ALLOWED_ORIGINS:-127.0.0.1,::1}
     env_file:
       - ../frontend/.env
     networks: