diff --git a/.github/actions/setup-rust-kache/action.yml b/.github/actions/setup-rust-kache/action.yml
index 3a9d225..e32d82b 100644
--- a/.github/actions/setup-rust-kache/action.yml
+++ b/.github/actions/setup-rust-kache/action.yml
@@ -73,7 +73,7 @@ runs:
         components: ${{ inputs.components }}
         targets: ${{ inputs.targets }}
 
-    # Pinned exactly. The private fleet and hosted CI share the 0.12.0 S3
+    # Pinned exactly. The private fleet and hosted CI share the 0.13.0 S3
     # object layout and daemon protocol. Floating this version could split cache
     # epochs or layouts without an obvious workflow failure. Bump deliberately,
     # never via tag drift.
@@ -81,7 +81,7 @@ runs:
       if: inputs.enable-cache == 'true' && runner.os == 'Linux'
       shell: bash
       env:
-        KACHE_VERSION: "0.12.0"
+        KACHE_VERSION: "0.13.0"
       run: |
         set -euo pipefail
         # Reuse any already-installed binary at the pinned version. Persistent
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6fa4fad..cf16704 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
                Format: ## [X.Y.Z] — YYYY-MM-DD
                Use Added / Changed / Deprecated / Removed / Fixed / Security headers. -->
 
+## [Unreleased]
+
+### Changed
+
+- Pin the shared Rust cache action to Kache 0.13.0 so hosted and self-hosted jobs use the same stabilized daemon protocol.
+- Add an explicit LAN-only production port binding while retaining the configurable primary bind address.
+
 ## [1.0.0](https://github.com/dinglebear-ai/synapse/compare/v0.6.2...v1.0.0) (2026-07-29)
 
 
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 5ebc7fa..669bb8d 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -55,6 +55,7 @@ services:
       # externally), override: SYNAPSE_MCP_BIND_HOST=0.0.0.0 in your .env and
       # change the mapping to: "${SYNAPSE_MCP_BIND_HOST:-127.0.0.1}:..."
       - "${SYNAPSE_MCP_BIND_HOST:-127.0.0.1}:${SYNAPSE_MCP_HOST_PORT:-40080}:40080/tcp"
+      - "10.1.0.6:${SYNAPSE_MCP_HOST_PORT:-40080}:40080/tcp"
     volumes:
       # Persistent appdata — config.toml, .env, auth.db, JWT key. The binary reads
       # config.toml / .env from here (it maps to /data inside the container).