diff --git a/contrib/claude/sandbox.md b/contrib/claude/sandbox.md
index 879c26950..b0d406ce5 100644
--- a/contrib/claude/sandbox.md
+++ b/contrib/claude/sandbox.md
@@ -19,7 +19,7 @@ Use a sandbox when you need to:
 
 # Build and start the app (probo-stack starts automatically on boot)
 ./contrib/lima/sandbox.sh exec -- make build
-./contrib/lima/sandbox.sh exec -- sudo systemctl start probod probo-console
+./contrib/lima/sandbox.sh exec -- sudo systemctl start probod probo-console probo-trust
 
 # Get the VM IP and service URLs
 ./contrib/lima/sandbox.sh status
@@ -41,6 +41,7 @@ After `sandbox.sh status`, use the VM IP to access services from the host:
 | Service | URL |
 |---|---|
 | Console | `http://<vm-ip>:5173` |
+| Trust | `http://<vm-ip>:5174` |
 | API | `http://<vm-ip>:8080` |
 | Grafana | `http://<vm-ip>:3001` |
 | Mailpit | `http://<vm-ip>:8025` |
@@ -71,19 +72,20 @@ This file is sourced during provisioning before `probod-bootstrap` runs. Any var
 
 ## Systemd services
 
-The sandbox provisions three systemd services:
+The sandbox provisions four systemd services:
 
 | Service | Description | Starts on boot |
 |---|---|---|
 | `probo-stack` | Docker Compose stack (Postgres, SeaweedFS, Keycloak, etc.) | Yes |
 | `probod` | Probo API server (depends on `probo-stack`) | No |
 | `probo-console` | Console frontend dev server | No |
+| `probo-trust` | Trust frontend dev server | No |
 
-`probo-stack` starts automatically when the VM boots. `probod` and `probo-console` must be started manually after building.
+`probo-stack` starts automatically when the VM boots. `probod`, `probo-console`, and `probo-trust` must be started manually after building.
 
 Manage them with `systemctl`:
 ```bash
-./contrib/lima/sandbox.sh exec -- sudo systemctl start probod probo-console
+./contrib/lima/sandbox.sh exec -- sudo systemctl start probod probo-console probo-trust
 ./contrib/lima/sandbox.sh exec -- sudo systemctl stop probod
 ./contrib/lima/sandbox.sh exec -- sudo systemctl restart probod
 ./contrib/lima/sandbox.sh exec -- sudo systemctl status probod
@@ -95,7 +97,7 @@ Manage them with `systemctl`:
 **Start the app:**
 ```bash
 ./contrib/lima/sandbox.sh exec -- make build
-./contrib/lima/sandbox.sh exec -- sudo systemctl start probod probo-console
+./contrib/lima/sandbox.sh exec -- sudo systemctl start probod probo-console probo-trust
 ```
 
 **Run tests:**
diff --git a/contrib/lima/README.md b/contrib/lima/README.md
index 5217f67d0..e498601be 100644
--- a/contrib/lima/README.md
+++ b/contrib/lima/README.md
@@ -22,11 +22,12 @@ brew install lima jq
 # Build the backend binary (probo-stack starts automatically on boot)
 ./contrib/lima/sandbox.sh exec -- make build
 
-# Start probod and the console dev server
-./contrib/lima/sandbox.sh exec -- sudo systemctl start probod probo-console
+# Start probod, the console, and the trust dev servers
+./contrib/lima/sandbox.sh exec -- sudo systemctl start probod probo-console probo-trust
 
 # Access services from your host browser using the VM IP
 # e.g. http://192.168.105.2:5173 (console)
+# e.g. http://192.168.105.2:5174 (trust)
 # e.g. http://192.168.105.2:8080 (API)
 ```
 
diff --git a/contrib/lima/provision.sh b/contrib/lima/provision.sh
index f738b0c38..8782a4eeb 100755
--- a/contrib/lima/provision.sh
+++ b/contrib/lima/provision.sh
@@ -100,6 +100,12 @@ su - "${LIMA_USER}" -c "export PATH=/usr/local/go/bin:\$HOME/go/bin:\$PATH && cd
 
 mkdir -p /etc/probod
 
+OAUTH2_SIGNING_KEY_PATH=/etc/probod/oauth2-signing-key.pem
+if [ ! -f "${OAUTH2_SIGNING_KEY_PATH}" ]; then
+    openssl genrsa -out "${OAUTH2_SIGNING_KEY_PATH}" 2048
+    chmod 600 "${OAUTH2_SIGNING_KEY_PATH}"
+fi
+
 # Load developer-specific overrides (not committed to repo).
 if [ -f /workspace/.sandbox.env ]; then
     set -a
@@ -113,6 +119,7 @@ AUTH_COOKIE_SECURE=false \
 AUTH_COOKIE_SECRET="this-is-a-secure-secret-for-cookie-signing-at-least-32-bytes" \
 AUTH_PASSWORD_PEPPER="this-is-a-secure-pepper-for-password-hashing-at-least-32-bytes" \
 PROBOD_ENCRYPTION_KEY="thisisnotasecretAAAAAAAAAAAAAAAAAAAAAAAAAAA=" \
+OAUTH2_SERVER_SIGNING_KEY="$(cat "${OAUTH2_SIGNING_KEY_PATH}")" \
 API_CORS_ALLOWED_ORIGINS="http://${VM_IP}:8080,http://${VM_IP}:5173,http://${VM_IP}:5174" \
 AWS_ENDPOINT="http://127.0.0.1:8333" \
 AWS_ACCESS_KEY_ID="probod" \
@@ -120,6 +127,10 @@ AWS_SECRET_ACCESS_KEY="thisisnotasecret" \
 AWS_USE_PATH_STYLE=true \
     /workspace/bin/probod-bootstrap -output /etc/probod/config.yml
 
+# probod runs as ${LIMA_USER} but bootstrap writes config.yml as root with 0600
+# because it contains secrets. Transfer ownership so probod can read it.
+chown "${LIMA_USER}:${LIMA_USER}" /etc/probod/config.yml "${OAUTH2_SIGNING_KEY_PATH}"
+
 echo "VITE_API_URL=http://${VM_IP}:8080" > /workspace/apps/console/.env
 echo "VITE_API_URL=http://${VM_IP}:8080" > /workspace/apps/trust/.env
 
@@ -129,7 +140,7 @@ cat > /etc/systemd/system/probo-node-modules.service << EOF
 [Unit]
 Description=Bind-mount VM-local node_modules over workspace
 DefaultDependencies=no
-Before=probo-console.service
+Before=probo-console.service probo-trust.service
 
 [Service]
 Type=oneshot
@@ -199,6 +210,33 @@ RestartSec=3s
 WantedBy=multi-user.target
 EOF
 
+cat > /etc/systemd/system/probo-trust.service << EOF
+[Unit]
+Description=Probo Trust Dev Server
+Requires=probo-node-modules.service
+After=probod.service probo-node-modules.service
+
+[Service]
+Type=simple
+User=${LIMA_USER}
+WorkingDirectory=/workspace
+ExecStart=/usr/bin/npm --workspace @probo/trust run dev -- --host 0.0.0.0
+Restart=on-failure
+RestartSec=3s
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
 systemctl daemon-reload
+systemctl enable --now probo-node-modules.service
 systemctl enable --now probo-stack.service
-systemctl enable probo-node-modules.service probod.service probo-console.service
+systemctl enable probod.service probo-console.service probo-trust.service
+
+# Populate VM-local node_modules with Linux-native binaries (esbuild, etc.).
+# The host's node_modules is macOS; `probo-node-modules.service` bind-mounts an
+# empty tree over /workspace/node_modules, and we install into it once here so
+# `make build` and the dev servers can run without cross-platform mismatches.
+if [ -z "$(ls -A /var/lib/probo/node_modules 2>/dev/null)" ]; then
+    su - "${LIMA_USER}" -c "cd /workspace && npm ci"
+fi
diff --git a/contrib/lima/sandbox.sh b/contrib/lima/sandbox.sh
index 1c7fd2e04..55334ecdb 100755
--- a/contrib/lima/sandbox.sh
+++ b/contrib/lima/sandbox.sh
@@ -128,6 +128,7 @@ cmd_status() {
         echo ""
         echo "Services (use VM IP to access from host):"
         echo "  Console:    http://${ip}:5173"
+        echo "  Trust:      http://${ip}:5174"
         echo "  API:        http://${ip}:8080"
         echo "  Grafana:    http://${ip}:3001"
         echo "  Mailpit:    http://${ip}:8025"