diff --git a/scripts/systemd/launch.sh b/scripts/systemd/launch.sh
index 6f72a00d7..4dad817a3 100755
--- a/scripts/systemd/launch.sh
+++ b/scripts/systemd/launch.sh
@@ -11,6 +11,10 @@ if [ -f "$HERE/.env" ]; then
   source "$HERE/.env"
   set +a
 fi
-unset HOSTNAME
+# `unset` does NOT bind to localhost — it makes Next fall back to ITS OWN
+# default, which is 0.0.0.0 (every interface). Found 2026-08-29: this left
+# orangecat reachable on all interfaces, mitigated only by ufw's
+# default-deny (not something to rely on as the actual boundary).
+export HOSTNAME=127.0.0.1
 export NODE_ENV="production"
 exec /usr/bin/node --max-http-header-size=65536 "$HERE/server.js"