diff --git a/src/backend/server.ts b/src/backend/server.ts
index b7b2952ee..bd35dfed5 100644
--- a/src/backend/server.ts
+++ b/src/backend/server.ts
@@ -622,12 +622,7 @@ export class PuterServer {
             res.setHeader('Access-Control-Allow-Methods', allowedMethods);
             res.setHeader('Access-Control-Allow-Headers', allowedHeaders);
 
-            // Private Network Access: grant public origins permission to
-            // reach loopback/private addresses (e.g. self-hosted Puter on
-            // localhost, or api.puter.com pointed at a local IP via hosts).
-            if (req.headers['access-control-request-private-network']) {
-                res.setHeader('Access-Control-Allow-Private-Network', 'true');
-            }
+            res.setHeader('Access-Control-Allow-Private-Network', 'true');
 
             // Disable iframes on the main domain
             if (req.hostname === config.domain) {
diff --git a/src/gui/src/UI/UIWindow.js b/src/gui/src/UI/UIWindow.js
index 8afdb4206..aad6d6f8e 100644
--- a/src/gui/src/UI/UIWindow.js
+++ b/src/gui/src/UI/UIWindow.js
@@ -407,7 +407,7 @@ async function UIWindow (options) {
                 style="${!options.has_head ? ' height: 100%;' : ''}">`;
     // iframe, for apps
     if ( options.iframe_url || options.iframe_srcdoc ) {
-        let allow_str = 'screen-wake-lock; picture-in-picture; document-picture-in-picture; camera; encrypted-media; gamepad; display-capture; geolocation; gyroscope; microphone; midi; clipboard-read; clipboard-write; fullscreen; web-share; file-system-handle; local-storage; downloads; autoplay;';
+        let allow_str = 'screen-wake-lock; picture-in-picture; document-picture-in-picture; camera; encrypted-media; gamepad; display-capture; geolocation; gyroscope; microphone; midi; clipboard-read; clipboard-write; fullscreen; web-share; file-system-handle; local-storage; downloads; autoplay; local-network-access;';
         if ( window.co_isolation_enabled )
         {
             allow_str += ' cross-origin-isolated;';