diff --git a/lib/startup.js b/lib/startup.js
index fb0167c..b0fddb1 100644
--- a/lib/startup.js
+++ b/lib/startup.js
@@ -28,15 +28,16 @@ Examples:
 /**
 * Parse and provide the Web invocation as an ordinary Cordis service. The
 * command's action publishes the flags this invocation named; `--host 0.0.0.0`
-* or a non-numeric `--port` is a usage error, so on rejection (and on `--help`)
-* nothing is provided.
+* (unless `DSH_PKG_ALLOW_LAN=1` opts in) or a non-numeric `--port` is a usage
+* error, so on rejection (and on `--help`) nothing is provided.
 * @param ctx - plugin context carrying the command line.
 */
 function apply(ctx) {
 	const program = webCommand();
 	program.action(() => {
 		const options = program.opts();
-		if (options.host === "0.0.0.0") program.error("error: --host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead");
+		const allowLan = process.env.DSH_PKG_ALLOW_LAN === "1";
+		if (options.host === "0.0.0.0" && !allowLan) program.error("error: --host 0.0.0.0 is blocked for safety: it would expose remote code execution to the network; set DSH_PKG_ALLOW_LAN=1 to opt in");
 		if (options.port !== void 0 && !/^\d+$/.test(options.port)) program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`);
 		ctx.provide(WEB_STARTUP_SERVICE, {
 			...options.host !== void 0 && { host: options.host },