diff --git a/mcp-server/server.py b/mcp-server/server.py
index 2126b72..6e20195 100644
--- a/mcp-server/server.py
+++ b/mcp-server/server.py
@@ -28,8 +28,18 @@ import urllib.request
 from typing import Any
 
 from mcp.server.fastmcp import FastMCP
+from mcp.server.transport_security import TransportSecuritySettings
 
-mcp = FastMCP("freshservice")
+# The streamable-HTTP transport enables DNS-rebinding protection by default,
+# which validates the Host header against an allow-list (localhost only when
+# empty) and returns HTTP 421 "Invalid Host header" otherwise. This server is
+# reached by LAN IP (e.g. 192.168.101.12:3839) from mcp-remote — not a browser —
+# and is already gated by a bearer token, so the protection only breaks the
+# connection. Disable it.
+mcp = FastMCP(
+    "freshservice",
+    transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False),
+)
 
 TICKET_STATUS = {2: "Open", 3: "Pending", 4: "Resolved", 5: "Closed"}
 TICKET_PRIORITY = {1: "Low", 2: "Medium", 3: "High", 4: "Urgent"}