diff --git a/compose.yml b/compose.yml
index f9b4439..13cc7d2 100644
--- a/compose.yml
+++ b/compose.yml
@@ -10,4 +10,5 @@ services:
       MCP_HOST: 0.0.0.0
       MCP_PORT: 8000
       MCP_AUTH_TOKEN: ${MCP_AUTH_TOKEN:-}
+      MCP_ALLOWED_HOSTS: ${MCP_ALLOWED_HOSTS:-}
     restart: on-failure
diff --git a/helm/templates/secret.yaml b/helm/templates/secret.yaml
index 3d2655c..f56a25e 100644
--- a/helm/templates/secret.yaml
+++ b/helm/templates/secret.yaml
@@ -12,4 +12,7 @@ stringData:
   {{- if .Values.auth.token }}
   MCP_AUTH_TOKEN: {{ .Values.auth.token | quote }}
   {{- end }}
+  {{- if .Values.auth.allowedHosts }}
+  MCP_ALLOWED_HOSTS: {{ .Values.auth.allowedHosts | quote }}
+  {{- end }}
 {{- end }}
diff --git a/helm/values.yaml b/helm/values.yaml
index f80b97b..8f72a2d 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -15,6 +15,9 @@ redmine:
 auth:
   # Bearer token for HTTP transport (leave empty to disable auth)
   token: ""
+  # Comma-separated list of additional allowed Host headers (e.g. your public domain)
+  # FastMCP allows only localhost by default — set this when running behind a reverse proxy
+  allowedHosts: ""
 
 service:
   type: ClusterIP
diff --git a/server.py b/server.py
index 7afe66b..df2803d 100644
--- a/server.py
+++ b/server.py
@@ -9,6 +9,8 @@ Environment variables:
   MCP_HOST        — bind host for HTTP transport (default: 0.0.0.0)
   MCP_PORT        — bind port for HTTP transport (default: 8000)
   MCP_AUTH_TOKEN  — Bearer token for HTTP transport auth (optional)
+  MCP_ALLOWED_HOSTS — Comma-separated extra allowed Host headers, e.g. redmine.mcp.example.com
+                      (FastMCP only allows localhost by default — required when behind a reverse proxy)
 """
 
 import os
@@ -24,6 +26,11 @@ if __name__ == "__main__":
         port = int(os.environ.get("MCP_PORT", "8000"))
         token = os.environ.get("MCP_AUTH_TOKEN", "")
 
+        allowed_hosts = os.environ.get("MCP_ALLOWED_HOSTS", "")
+        if allowed_hosts:
+            for h in (h.strip() for h in allowed_hosts.split(",")):
+                mcp.settings.transport_security.allowed_hosts.append(h)
+
         app = mcp.streamable_http_app()
 
         if token: