diff --git a/pkg/server/api/complianceportal/v1/oauth_initiate_handler.go b/pkg/server/api/complianceportal/v1/oauth_initiate_handler.go
index 7bd37e3ec..963c5cadb 100644
--- a/pkg/server/api/complianceportal/v1/oauth_initiate_handler.go
+++ b/pkg/server/api/complianceportal/v1/oauth_initiate_handler.go
@@ -45,9 +45,11 @@ func NewOAuthInitiateHandler(
 		proboBaseURL: proboBaseURL,
 		visitor:      visitorSvc,
 		safeRedirect: saferedirect.New(allowedHost),
+		// proboBaseURL is server config, not user input — loopback is expected in dev.
 		httpClient: httpclient.DefaultClient(
 			httpclient.WithLogger(logger),
 			httpclient.WithSSRFProtection(),
+			httpclient.WithSSRFAllowLoopback(),
 		),
 		logger: logger,
 	}