diff --git a/hosts/heather/caddy.nix b/hosts/heather/caddy.nix
index 9446722..86925a6 100644
--- a/hosts/heather/caddy.nix
+++ b/hosts/heather/caddy.nix
@@ -35,8 +35,14 @@ in {
 
     virtualHosts = {
       # --- Syncthing GUI (host-сервис) ---
+      # header_up Host 127.0.0.1:8384 — обходим syncthing host-check (DNS
+      # rebinding protection): syncthing сравнивает Host header с адресом
+      # прослушивания (127.0.0.1:8384) и отдаёт 403 "Host check error" для
+      # внешних доменов. Подменяем Host на бэкенде.
       "sync.iscg.dev".extraConfig = syncBasicAuth + ''
-        reverse_proxy 127.0.0.1:8384
+        reverse_proxy 127.0.0.1:8384 {
+          header_up Host 127.0.0.1:8384
+        }
       '';
 
       # --- Контейнеры (arion, см. arion-compose.nix) ---