diff --git a/cloudcli b/cloudcli
index 25ad334..d12813e 160000
--- a/cloudcli
+++ b/cloudcli
@@ -1 +1 @@
-Subproject commit 25ad3342d3843aae51e76cde5588a7b594341a53
+Subproject commit d12813e1253f2075f50a375f00d245f82f214c43
diff --git a/plugin-taskwork b/plugin-taskwork
index cadd21e..fdae524 160000
--- a/plugin-taskwork
+++ b/plugin-taskwork
@@ -1 +1 @@
-Subproject commit cadd21e8fed0237575f873d5f2abca8a01356163
+Subproject commit fdae5240077e0c014f17ef50eb38b0b6748b63e7
diff --git a/scripts/dev-host-proxy.sh b/scripts/dev-host-proxy.sh
index e47b19d..756a97c 100755
--- a/scripts/dev-host-proxy.sh
+++ b/scripts/dev-host-proxy.sh
@@ -13,8 +13,20 @@ export http_proxy="$HTTP_PROXY"
 export https_proxy="$HTTPS_PROXY"
 export no_proxy="$NO_PROXY"
 
+# Reaching the host through a name rather than localhost — publishing it behind
+# a port forward or a reverse proxy — needs that name allowed: Vite answers
+# "Blocked request. This host is not allowed." to every other Host header.
+#
+# ALLOWED_HOST carries it. The variable Vite reads is its own escape hatch: it
+# appends the value to server.allowedHosts, so cloudcli/vite.config.js stays
+# untouched. One name per run — the value is appended whole, commas are not
+# split. Unset means an empty string, which Vite ignores, so leaving it alone
+# keeps the default localhost-only behaviour.
+export __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS="${ALLOWED_HOST:-}"
+
 echo "-------"
 echo "HTTP_PROXY=${HTTP_PROXY}"
+echo "ALLOWED_HOST=${ALLOWED_HOST:-(none, localhost only)}"
 echo "-------"