diff --git a/server/README.md b/server/README.md
index 26ded98..c67fca2 100644
--- a/server/README.md
+++ b/server/README.md
@@ -64,5 +64,9 @@ iteration against your own Dockerfile changes.
 python3 -m venv .venv
 source .venv/bin/activate
 pip install -r requirements.txt
-CONFIG_PATH=./data/config.json uvicorn app.main:app --reload --port 8420
+CONFIG_PATH=./data/config.json uvicorn app.main:app --reload --host 0.0.0.0 --port 8420
 ```
+
+`--host 0.0.0.0` matters here: without it, uvicorn defaults to
+`127.0.0.1` (localhost-only), which the ESP32 can't reach over the LAN.
+The Docker image already binds `0.0.0.0` by default.
diff --git a/server/requirements.txt b/server/requirements.txt
index bc4896b..936ae7b 100644
--- a/server/requirements.txt
+++ b/server/requirements.txt
@@ -2,6 +2,6 @@ fastapi==0.115.6
 starlette==0.41.3
 uvicorn[standard]==0.34.0
 httpx==0.28.1
-pillow==11.1.0
+pillow==12.3.0
 python-multipart==0.0.20
 jinja2==3.1.5