diff --git a/scripts/embed.bat b/scripts/embed.bat
index 7f6fb9b..0d68565 100644
--- a/scripts/embed.bat
+++ b/scripts/embed.bat
@@ -34,6 +34,19 @@ set "SYS=%SystemRoot%\System32"
 if not defined LLAMA_DIR set "LLAMA_DIR=%USERPROFILE%\apps\llama.cpp"
 if not defined EMBED_MODEL set "EMBED_MODEL=%USERPROFILE%\.models\Qwen3-Embedding-0.6B-Q8_0.gguf"
 if not defined EMBED_PORT set "EMBED_PORT=11434"
+rem EMBED_HOST: which interface llama-server binds to.
+rem Default 0.0.0.0 = the owner's call (2026-10-07). TWO FACTS, both measured
+rem on this machine -- know them before changing this value back and forth:
+rem   1) llama-server has NO auth. Binding 0.0.0.0 exposes this machine's
+rem      embedding compute to EVERY device on the LAN. Set EMBED_HOST=127.0.0.1
+rem      to keep it local-only again.
+rem   2) 0.0.0.0 is an IPv4 wildcard and does NOT cover IPv6 -- MEASURED on
+rem      this machine (2026-10-07): with --host 0.0.0.0, netstat shows only
+rem      "TCP 0.0.0.0:11434 LISTENING" (no IPv6 entry) and http://[::1]:11434
+rem      still fails. So a client that resolves "localhost" to ::1 still
+rem      cannot reach it; clients must dial 127.0.0.1 (see
+rem      internal/runtime/embedding). Binding 0.0.0.0 does NOT fix that.
+if not defined EMBED_HOST set "EMBED_HOST=0.0.0.0"
 set "SERVER=%LLAMA_DIR%\llama-server.exe"
 set "LOG_FILE=%USERPROFILE%\llama.log"
 set "STDOUT_FILE=%USERPROFILE%\llama.stdout.log"
@@ -68,7 +81,7 @@ if not exist "%EMBED_MODEL%" (
   exit /b 1
 )
 echo Starting llama-server -^> %EMBED_MODEL%  ^(port %EMBED_PORT%^)
-powershell -NoProfile -Command "Start-Process -FilePath '%SERVER%' -ArgumentList '-m','%EMBED_MODEL%','--embeddings','--host','127.0.0.1','--port','%EMBED_PORT%','-c','4096','-b','2048','-ub','2048','-t','8' -WorkingDirectory '%LLAMA_DIR%' -RedirectStandardOutput '%STDOUT_FILE%' -RedirectStandardError '%LOG_FILE%' -WindowStyle Hidden"
+powershell -NoProfile -Command "Start-Process -FilePath '%SERVER%' -ArgumentList '-m','%EMBED_MODEL%','--embeddings','--host','%EMBED_HOST%','--port','%EMBED_PORT%','-c','4096','-b','2048','-ub','2048','-t','8' -WorkingDirectory '%LLAMA_DIR%' -RedirectStandardOutput '%STDOUT_FILE%' -RedirectStandardError '%LOG_FILE%' -WindowStyle Hidden"
 set /a TRIES=0
 :start_wait
 set /a TRIES+=1