diff --git a/docker-compose.yml b/docker-compose.yml
index 31b4ef03..4efb96db 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -335,6 +335,7 @@ services:
     environment:
       TANGLED_DEV: "true"
       TANGLED_APPVIEW_HOST: 127.0.0.1:3000
+      TANGLED_XRPC_ENABLED: "true"
       TANGLED_DB_PATH: /var/lib/appview/appview.db
       TANGLED_PLC_URL: https://plc.tngl.boltless.dev
       TANGLED_JETSTREAM_ENDPOINT: wss://jetstream.tngl.boltless.dev/subscribe
@@ -452,6 +453,11 @@ services:
     restart: unless-stopped
     environment:
       BOBBIN_URL: https://bobbin.tngl.boltless.dev
+      # browser-reachable appview for authed xrpc; host must match the
+      # appview's TANGLED_APPVIEW_HOST so the service-auth aud lines up
+      TANGLED_API_URL: http://127.0.0.1:3000
+      # suffix shown in the sites claim UI; must match the appview's TANGLED_SITES_DOMAIN
+      SITES_DOMAIN: tngl.io
       KNOTMIRROR_URL: https://mirror.tngl.boltless.dev
       CAMO_URL: https://camo.tngl.boltless.dev
       CAMO_SHARED_SECRET: localinfra-camo-secret