diff --git a/src/constants.ts b/src/constants.ts
index 8d295cc..16f02db 100644
--- a/src/constants.ts
+++ b/src/constants.ts
@@ -8,10 +8,13 @@ export const APP_ROOT = path.join(__dirname, '..');
 
 export const ALLOWED_ORIGINS = IS_PROD_BUILD
     ? [
-        // Prod builds only allow HTTPS app.httptoolkit.tech usage. This
-        // ensures that no other sites/apps can communicate with your server
-        // whilst you have the app open. If they could (requires an HTTP mitm),
-        // they would be able to start proxies & interceptors.
+        // Self-hosted build: the UI is served locally by this same binary, so we
+        // must allow localhost origins here (upstream prod allows only
+        // app.httptoolkit.tech). This matches upstream's *dev* allowlist. Trade-off:
+        // any local http page could talk to the server while it's running.
+        /^https?:\/\/localhost(:\d+)?$/,
+        /^https?:\/\/127\.0\.0\.\d+(:\d+)?$/,
+        /^http:\/\/local\.httptoolkit\.tech(:\d+)?$/,
         /^https:\/\/app\.httptoolkit\.tech$/
     ]
     : [