diff --git a/cmd/msa-agent/main.go b/cmd/msa-agent/main.go
index 0f215ac..fd54c64 100644
--- a/cmd/msa-agent/main.go
+++ b/cmd/msa-agent/main.go
@@ -15,6 +15,7 @@ import (
 	"flag"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -47,6 +48,7 @@ func main() {
 		once       = flag.Bool("once", false, "run a single poll cycle and exit")
 		pairMode   = flag.Bool("pair", false, "open the temporary pairing window on the LAN and exit when it closes")
 		pairPort   = flag.Int("pair-port", pair.DefaultAdminPort, "port for the pairing window's management listener")
+		pairBind   = flag.String("pair-bind", pair.DefaultAdminHost, "address the pairing window binds to")
 	)
 	flag.Parse()
 
@@ -55,7 +57,7 @@ func main() {
 
 	var err error
 	if *pairMode {
-		err = runPair(*configPath, *pairPort)
+		err = runPair(*configPath, *pairPort, *pairBind)
 	} else {
 		err = run(*configPath, *check, *once)
 	}
@@ -71,7 +73,7 @@ func main() {
 // the invariant "the agent binds no socket" is a property of the daemon; the pairing window is a
 // deliberate, operator-started exception with three independent shutdowns (first pairing, attempt
 // ceiling, deadline). Pairing is run again by the operator for each additional phone.
-func runPair(configPath string, adminPort int) error {
+func runPair(configPath string, adminPort int, adminHost string) error {
 	cfg, err := config.LoadForPairing(configPath)
 	if err != nil {
 		return err
@@ -82,13 +84,19 @@ func runPair(configPath string, adminPort int) error {
 	if err != nil {
 		return err
 	}
+	if net.ParseIP(adminHost) == nil {
+		// A name here would be resolved at bind time, and the window is the one place the agent holds a
+		// listener: an operator who typed a hostname would get whatever that name resolved to, which is
+		// not a decision they made deliberately. The default is a literal for that reason.
+		return fmt.Errorf("pair-bind must be an IP literal, got %q", adminHost)
+	}
 	server := &http.Server{
-		Addr:              ":" + strconv.Itoa(adminPort),
+		Addr:              net.JoinHostPort(adminHost, strconv.Itoa(adminPort)),
 		Handler:           handler.Routes(),
 		ReadHeaderTimeout: 5 * time.Second,
 	}
 	go func() {
-		slog.Info("pairing window open", "port", adminPort, "node", cfg.NodeID)
+		slog.Info("pairing window open", "bind", adminHost, "port", adminPort, "node", cfg.NodeID)
 		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 			slog.Error("pairing listener failed", "error", err)
 			handler.Close()
diff --git a/internal/pair/pair.go b/internal/pair/pair.go
index a9bf36e..447c09c 100644
--- a/internal/pair/pair.go
+++ b/internal/pair/pair.go
@@ -30,9 +30,26 @@ import (
 // Limits. The attempt ceiling is small on purpose: the pairing secret is a human password, and a
 // window where anyone on the LAN can try it a thousand times is a window that leaks the node.
 const (
-	MaxAttempts      = 10
-	DefaultWindow    = 10 * time.Minute
-	MaxRequestBytes  = 8 << 10
+	MaxAttempts     = 10
+	DefaultWindow   = 10 * time.Minute
+	MaxRequestBytes = 8 << 10
+	// DefaultAdminHost is a literal, not a name and not empty.
+	//
+	// The window grants device trust: whoever reaches /provision with the node password gets a key the
+	// agent will obey. So the bind address decides who can even attempt that, and the default has to be
+	// the narrowest thing that still lets the documented flow work.
+	//
+	// It cannot be 127.0.0.1. Pairing happens over the LAN by design — the phone dials the node's LAN
+	// address, which is what makes a QR code unnecessary — and a listener on loopback is not reachable
+	// from another host. A loopback default would not be a hardening measure; it would be a flow that
+	// never works, and the operator's first experience of this feature would be a refused connection
+	// with no explanation.
+	//
+	// It is a literal rather than a name for a different reason: a name is resolved at bind time, so the
+	// listening address would depend on what DNS said at that moment. That is not a decision the
+	// operator made, and on a node whose resolver is compromised it is a decision someone else made.
+	// Operators who want a narrower or wider bind pass --pair-bind.
+	DefaultAdminHost = "0.0.0.0"
 	DefaultAdminPort = 3001
 )
 
diff --git a/internal/pair/pair_test.go b/internal/pair/pair_test.go
index 614929c..3e524cd 100644
--- a/internal/pair/pair_test.go
+++ b/internal/pair/pair_test.go
@@ -6,6 +6,7 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -280,3 +281,25 @@ func TestServeDeadlineClosesTheWindow(t *testing.T) {
 		t.Fatalf("status after the deadline: %d", response.StatusCode)
 	}
 }
+
+// The window's default bind has to satisfy two things at once, and they pull in opposite directions.
+//
+// It must be reachable from the phone: pairing happens over the LAN by design, so a loopback default
+// would be a flow that never works. And it must be a literal rather than a name: a name is resolved at
+// bind time, so the listening address would depend on what DNS said, which is not a decision the
+// operator made.
+func TestTheDefaultBindIsALiteralAndIsReachableFromTheLAN(t *testing.T) {
+	if net.ParseIP(DefaultAdminHost) == nil {
+		t.Fatalf("%q is not an IP literal; a name would be resolved at bind time", DefaultAdminHost)
+	}
+	ip := net.ParseIP(DefaultAdminHost)
+	if ip.IsLoopback() {
+		t.Fatal("a loopback default cannot be reached from the phone, and pairing is a LAN flow")
+	}
+	// Any-address is the default because the documented flow requires it; the operator narrows it with
+	// --pair-bind when the node is routable from somewhere it should not be.
+	if !ip.IsUnspecified() {
+		t.Fatalf("the default bind changed to %q; the documented flow and the deployment notes assume %q",
+			DefaultAdminHost, "0.0.0.0")
+	}
+}