diff --git a/src/config.rs b/src/config.rs
index 619a58e1..627fa89d 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,4 +1,4 @@
-use std::{fs, path::PathBuf};
+use std::{fs, net::IpAddr, path::PathBuf};
 
 use clap::Parser;
 use serde::Deserialize;
@@ -99,6 +99,9 @@ pub struct Config {
     #[arg(long, env = "DEFGUARD_FW_PRIORITY")]
     #[serde(default)]
     pub fw_priority: Option<i32>,
+
+    #[arg(long, env = "DEFGUARD_HTTP_BIND_ADDRESS")]
+    pub http_bind_address: Option<IpAddr>,
 }
 
 impl Default for Config {
@@ -123,6 +126,7 @@ impl Default for Config {
             health_port: None,
             masquerade: false,
             fw_priority: None,
+            http_bind_address: None,
         }
     }
 }
diff --git a/src/main.rs b/src/main.rs
index b2270125..ce5b2317 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -59,7 +59,11 @@ async fn main() -> Result<(), GatewayError> {
 
     let mut tasks = JoinSet::new();
     if let Some(health_port) = config.health_port {
-        tasks.spawn(run_server(health_port, Arc::clone(&gateway.connected)));
+        tasks.spawn(run_server(
+            health_port,
+            config.http_bind_address,
+            Arc::clone(&gateway.connected),
+        ));
     }
     tasks.spawn(async move { gateway.start().await });
     while let Some(Ok(result)) = tasks.join_next().await {
diff --git a/src/server.rs b/src/server.rs
index f0ea62a8..2f25848b 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -21,13 +21,20 @@ async fn healthcheck<'a>(
     }
 }
 
-pub async fn run_server(http_port: u16, connected: Arc<AtomicBool>) -> Result<(), GatewayError> {
+pub async fn run_server(
+    http_port: u16,
+    http_bind_address: Option<IpAddr>,
+    connected: Arc<AtomicBool>,
+) -> Result<(), GatewayError> {
     let app = Router::new()
         .route("/health", get(healthcheck))
         .layer(Extension(connected));
 
     // run server
-    let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), http_port);
+    let addr = SocketAddr::new(
+        http_bind_address.unwrap_or(IpAddr::V4(Ipv4Addr::UNSPECIFIED)),
+        http_port,
+    );
     let listener = TcpListener::bind(&addr).await?;
     info!("Health check listening on {addr}");
     serve(listener, app.into_make_service())