diff --git a/apps/server/.env.example b/apps/server/.env.example
index cf35dd9..b2eeab5 100644
--- a/apps/server/.env.example
+++ b/apps/server/.env.example
@@ -42,6 +42,9 @@ EVENT_SIGNING_KEY=
 # The Tauri DESKTOP shell loads from tauri://localhost (Linux may also send
 # http://tauri.localhost), which is NOT same-origin with the backend — add both
 # so the desktop app's live feed connects. See apps/desktop.
+# To open the dev SPA from another LAN device (phone over wifi), Vite must bind
+# 0.0.0.0 (vite.config.ts) AND the host's LAN origin must be listed here, e.g.
+# http://10.0.10.203:5173 — the WS handshake's Origin is that LAN address.
 WS_ALLOWED_ORIGINS=http://localhost:5173,tauri://localhost,http://tauri.localhost
 
 # Vision / ANPR (optional) -------------------------------------------------
diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
index 5598c02..a3a0940 100644
--- a/apps/web/vite.config.ts
+++ b/apps/web/vite.config.ts
@@ -9,6 +9,12 @@ export default defineConfig({
   plugins: [react(), tailwindcss()],
   server: {
     port: 5173,
+    // Bind all interfaces so the dev SPA is reachable from other LAN devices
+    // (phone over wifi, etc.) at http://<host-lan-ip>:5173 — not just localhost.
+    // NB: loading from a non-localhost origin means the booth WebSocket (/api/ws)
+    // sends Origin: http://<host-lan-ip>:5173, which the backend's WS_ALLOWED_ORIGINS
+    // must include or the live feed is rejected. See apps/server/.env(.example).
+    host: "0.0.0.0",
     proxy: {
       // Use 127.0.0.1 (not "localhost") so the proxy never tries IPv6 ::1
       // first and stall — the backend binds IPv4. Avoids slow/hung requests,