diff --git a/roles/test-e2e-cli/files/shared/mcp/contract.py b/roles/test-e2e-cli/files/shared/mcp/contract.py
index 8ac0a5f68d..4af0b34781 100644
--- a/roles/test-e2e-cli/files/shared/mcp/contract.py
+++ b/roles/test-e2e-cli/files/shared/mcp/contract.py
@@ -116,7 +116,6 @@ def rpc(method, params=None, authorization=None, url=None, notification=False):
     request.add_header("Accept", "application/json, text/event-stream")
     if HOST_HEADER:
         request.add_header("Host", HOST_HEADER)
-        request.add_header("X-Forwarded-Proto", "https")
     if authorization:
         request.add_header("Authorization", authorization)
     if SESSION["id"]:
diff --git a/roles/web-app-wordpress/files/mu-plugins/infinito-mcp-abilities.php b/roles/web-app-wordpress/files/mu-plugins/infinito-mcp-abilities.php
index 0c860548bc..c488bee87b 100644
--- a/roles/web-app-wordpress/files/mu-plugins/infinito-mcp-abilities.php
+++ b/roles/web-app-wordpress/files/mu-plugins/infinito-mcp-abilities.php
@@ -60,7 +60,15 @@ add_filter( 'rest_pre_dispatch', 'infinito_mcp_guard_transport', 10, 3 );
  * @param bool $available Whether core already considers them available.
  */
 function infinito_mcp_app_passwords_available( $available ) {
-	return $available || 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME );
+	if ( $available || 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ) ) {
+		return true;
+	}
+	$internal = getenv( 'WORDPRESS_INTERNAL_HOST' );
+	if ( ! $internal ) {
+		return false;
+	}
+	$host = isset( $_SERVER['HTTP_HOST'] ) ? explode( ':', wp_unslash( $_SERVER['HTTP_HOST'] ) )[0] : '';
+	return $host === $internal;
 }
 
 add_filter( 'wp_is_application_passwords_available', 'infinito_mcp_app_passwords_available' );
diff --git a/roles/web-app-wordpress/templates/env.j2 b/roles/web-app-wordpress/templates/env.j2
index 0393660ec8..057e6c5163 100644
--- a/roles/web-app-wordpress/templates/env.j2
+++ b/roles/web-app-wordpress/templates/env.j2
@@ -7,6 +7,8 @@ WORDPRESS_DB_NAME={{ lookup('database', application_id, 'name') }}
 
 WP_CLI_CACHE_DIR=/tmp/wp-cli-cache
 
+WORDPRESS_INTERNAL_HOST={{ WORDPRESS_MCP_SERVICE_KEY }}
+
 WP_DEBUG={{ MODE_DEBUG | lower }}
 WP_DEBUG_LOG={{ MODE_DEBUG | lower }}
 WP_DEBUG_DISPLAY={{ MODE_DEBUG | lower }}
diff --git a/roles/web-app-wordpress/vars/main.yml b/roles/web-app-wordpress/vars/main.yml
index cfe75648c2..52562c5cb8 100644
--- a/roles/web-app-wordpress/vars/main.yml
+++ b/roles/web-app-wordpress/vars/main.yml
@@ -22,6 +22,7 @@ WORDPRESS_USER: "www-data"
 WORDPRESS_LITELLM_ENV_ID: "{{ lookup('config', application_id, 'addons.ai-engine.config.environment.id') }}"
 WORDPRESS_MCP_ENABLED: "{{ lookup('config', application_id, 'mcp.enabled') }}"
 WORDPRESS_MCP_ADAPTER_VERSION: "{{ lookup('config', application_id, 'addons.mcp-adapter.version') }}"
+WORDPRESS_MCP_SERVICE_KEY: "{{ lookup('config', application_id, 'mcp.endpoint.service_key') }}"
 WORDPRESS_MCP_ACCOUNT: "{{ lookup('users', 'mcp-web-app-wordpress') }}"
 WORDPRESS_MCP_USERNAME: "{{ WORDPRESS_MCP_ACCOUNT.username }}"
 WORDPRESS_MCP_EMAIL: "{{ WORDPRESS_MCP_ACCOUNT.email }}"