diff --git a/README.md b/README.md
index 75cec5d..646254e 100644
--- a/README.md
+++ b/README.md
@@ -101,6 +101,8 @@ Set-Location E:\Codex\story\platform
 - 模拟语音供应商存活检查：<http://localhost:59200/health/live>
 - 模拟告警接收器存活检查：<http://localhost:59210/health/live>
 
+Web也允许通过`http://127.0.0.1:3100`访问；本地Keycloak客户端为`localhost`和`127.0.0.1`分别登记了3100生产预览端口与5173前端开发端口，登录回调必须保持当前浏览器来源一致。
+
 本地Web点击“登录研发环境”后可使用`owner`、`editor`或`outsider`三个合成账号，密码均为`LocalOnly123!`。账号只用于本机联调，权限说明见[家庭角色权限矩阵](docs/permission-matrix.md)。
 
 Web镜像在容器启动时根据`WEB_OIDC_AUTHORITY`和`WEB_OIDC_CLIENT_ID`生成不缓存的`runtime-config.js`。dev、preprod和prod可复用同一镜像，只需为各环境设置对应OIDC地址和客户端编号；这些值是浏览器可见的公开配置，不能用于保存客户端密钥。
diff --git a/deploy/keycloak/realm-voice-local.json b/deploy/keycloak/realm-voice-local.json
index be76694..916c1a2 100644
--- a/deploy/keycloak/realm-voice-local.json
+++ b/deploy/keycloak/realm-voice-local.json
@@ -15,8 +15,18 @@
       "publicClient": true,
       "standardFlowEnabled": true,
       "directAccessGrantsEnabled": true,
-      "redirectUris": ["http://localhost:3100/*", "http://localhost:5173/*"],
-      "webOrigins": ["http://localhost:3100", "http://localhost:5173"],
+      "redirectUris": [
+        "http://localhost:3100/*",
+        "http://127.0.0.1:3100/*",
+        "http://localhost:5173/*",
+        "http://127.0.0.1:5173/*"
+      ],
+      "webOrigins": [
+        "http://localhost:3100",
+        "http://127.0.0.1:3100",
+        "http://localhost:5173",
+        "http://127.0.0.1:5173"
+      ],
       "protocol": "openid-connect",
       "protocolMappers": [
         {