diff --git a/.env.production.example b/.env.production.example
index dcfe5afeb..2a3edb30a 100644
--- a/.env.production.example
+++ b/.env.production.example
@@ -162,6 +162,12 @@ API_TOKEN_HMAC_KEY="<openssl rand -hex 32>"
 # docs/ops/tls-cert-pin.md for extraction + the re-pin runbook.
 # TLS_LEAF_SPKI_PINS=""
 
+# Local-AI SSRF opt-in (optional). The local AI provider rejects private/
+# internal hosts by default. Set to an exact host allowlist (comma-separated,
+# e.g. "ollama.lan,10.0.0.5") or "true" for any private host — intended for a
+# self-hosted Ollama / LM Studio endpoint. See docs/integrations/ai-providers.md.
+# ALLOW_LOCAL_AI_PRIVATE_HOSTS=""
+
 
 # -----------------------------------------------------------------------------
 # Off-host backups -- all-or-none
diff --git a/docker-compose.yml b/docker-compose.yml
index f28293eee..8b12fe468 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -146,6 +146,13 @@ services:
       # container (the `environment:` block is a whitelist). See
       # docs/ops/tls-cert-pin.md.
       TLS_LEAF_SPKI_PINS: "${TLS_LEAF_SPKI_PINS:-}"
+      # Local-AI SSRF opt-in (optional). The local AI provider rejects
+      # private/internal hosts by default; set this to an exact host allowlist
+      # (e.g. "ollama.lan,10.0.0.5") or "true" for any private host, intended
+      # for a self-hosted Ollama / LM Studio. Listed here so an operator value
+      # in .env reaches the container (the `environment:` block is a whitelist).
+      # See docs/integrations/ai-providers.md.
+      ALLOW_LOCAL_AI_PRIVATE_HOSTS: "${ALLOW_LOCAL_AI_PRIVATE_HOSTS:-}"
       # v1.17.1 — SMTP transport for the email notification channel (optional,
       # all-or-none: HOST + PORT + FROM enable it; USER/PASS optional; SECURE
       # toggles implicit TLS). Listed here so operator values in .env reach the