diff --git a/.env.example b/.env.example
index f54b3de..200ea0f 100644
--- a/.env.example
+++ b/.env.example
@@ -14,6 +14,9 @@ CORS_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
 # Optional. Leave empty for same-origin /api proxy via frontend nginx.
 VITE_API_URL=
 
+# Frontend dev proxy target (for `frontend/vite` local development)
+VITE_API_PROXY_TARGET=http://backend:8000
+
 # RIPEstat
 RIPESTAT_BASE_URL=https://stat.ripe.net/data
 RIPESTAT_CACHE_TTL_SECONDS=900
diff --git a/README.md b/README.md
index cffc6ca..b11f1e2 100644
--- a/README.md
+++ b/README.md
@@ -207,6 +207,11 @@ docker compose -f docker-compose.prod.yml up -d --build
 
 In the standard setup, RouteForge does **not** require a hardcoded host IP in the frontend build. The frontend nginx proxies `/api` internally to the backend service (`backend:8000`).
 
+For frontend Vite development proxying:
+- Docker Compose default: `VITE_API_PROXY_TARGET=http://backend:8000`
+- Local development outside Docker: `VITE_API_PROXY_TARGET=http://localhost:8000`
+- Do not commit local/private IP targets (for example `192.168.x.x`, `10.x.x.x`, `172.16-31.x.x`) to the repository.
+
 ### Environment
 - `.env.example` documents required production variables.
 - Keep RouteForge read-only (no write operations to RIPE DB, RPKI, or routers).
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index 22ca89a..589f32e 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -1,12 +1,14 @@
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
 
+const apiProxyTarget = process.env.VITE_API_PROXY_TARGET || 'http://backend:8000'
+
 export default defineConfig({
   plugins: [react()],
   server: {
     proxy: {
       '/api': {
-        target: 'http://192.168.58.167:8000',
+        target: apiProxyTarget,
         changeOrigin: true,
       },
     },