diff --git a/src/fabledassistant/mcp/server.py b/src/fabledassistant/mcp/server.py
index 453cd17..b686b92 100644
--- a/src/fabledassistant/mcp/server.py
+++ b/src/fabledassistant/mcp/server.py
@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 from mcp.server.fastmcp import FastMCP
+from mcp.server.transport_security import TransportSecuritySettings
 from quart import Quart
 
 _INSTRUCTIONS = """
@@ -23,8 +24,24 @@ Hierarchy: Project -> Milestone -> Task/Note.
 
 
 def build_mcp_server() -> FastMCP:
-    """Build the FastMCP instance with all tools registered."""
-    mcp = FastMCP("scribe", instructions=_INSTRUCTIONS.strip())
+    """Build the FastMCP instance with all tools registered.
+
+    DNS-rebinding protection is disabled: FastMCP's default allow-list is
+    just localhost variants, which means any deployment behind a reverse
+    proxy (Traefik with a hostname like devassistant.traefik.internal,
+    Cloudflare, nginx, etc.) gets 421 Misdirected Request. The threat
+    model that protection addresses — a malicious browser page rebinding
+    DNS to hit a localhost MCP — doesn't apply here: this is HTTP transport
+    behind a reverse proxy with bearer-token auth as the real security
+    boundary.
+    """
+    mcp = FastMCP(
+        "scribe",
+        instructions=_INSTRUCTIONS.strip(),
+        transport_security=TransportSecuritySettings(
+            enable_dns_rebinding_protection=False,
+        ),
+    )
     from fabledassistant.mcp.tools import register_all
     register_all(mcp)
     return mcp