diff --git a/CHANGELOG.md b/CHANGELOG.md
index 45bf03b..f019c60 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Suppress bandit B104 false positive for `HOST = "0.0.0.0"` in `config.py`; binding to all interfaces is intentional for containerised deployments.
+
 ### Fixed
 
 - Fix timezone display in Mailbox Activity / Admin Logs pages: timestamps from the server were parsed as local time when no timezone indicator was present, causing relative times ("1h ago") and absolute dates to be shifted by the client's UTC offset.
diff --git a/backend/app/core/config.py b/backend/app/core/config.py
index 44b2cea..9d12315 100644
--- a/backend/app/core/config.py
+++ b/backend/app/core/config.py
@@ -36,7 +36,9 @@ class Settings(BaseSettings):
     API_V1_PREFIX: str = "/api/v1"
 
     # Server
-    HOST: str = "0.0.0.0"
+    HOST: str = (
+        "0.0.0.0"  # nosec B104 – intentional: containerised service binds all interfaces
+    )
     PORT: int = 8000
 
     # Database