diff --git a/.env.example b/.env.example
index e85dafd..9275d5e 100644
--- a/.env.example
+++ b/.env.example
@@ -8,6 +8,7 @@ PIPELINE_ENV_FILE=./pipeline.env
 AIRFLOW_IMAGE=etl-workbench:local
 
 AIRFLOW_UI_PORT=18080
+AIRFLOW_UI_HOST=127.0.0.1
 MINIO_API_PORT=59000
 MINIO_CONSOLE_PORT=59001
 ETL_LOCAL_BUCKET=etl-local
diff --git a/README.md b/README.md
index 9aeace8..114e1ea 100644
--- a/README.md
+++ b/README.md
@@ -43,6 +43,10 @@ docker compose exec airflow \
   cat /var/lib/airflow/simple_auth_manager_passwords.json.generated
 ```
 
+To expose only the authenticated Airflow UI on a trusted local network, set
+`AIRFLOW_UI_HOST=0.0.0.0` when starting the launcher. Database and object-store
+ports keep their localhost-only defaults.
+
 Useful options:
 
 ```text
diff --git a/compose.yaml b/compose.yaml
index e6d9496..ab728d9 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -26,7 +26,7 @@ services:
     environment:
       <<: *airflow-environment
     ports:
-      - "127.0.0.1:${AIRFLOW_UI_PORT:-18080}:8080"
+      - "${AIRFLOW_UI_HOST:-127.0.0.1}:${AIRFLOW_UI_PORT:-18080}:8080"
     volumes:
       - airflow-home:/var/lib/airflow
     depends_on: