diff --git a/api/src/serve.rs b/api/src/serve.rs
index 0bb67a9..a797234 100644
--- a/api/src/serve.rs
+++ b/api/src/serve.rs
@@ -25,6 +25,10 @@ pub async fn run() -> Result<(), Box<dyn std::error::Error>> {
     let qa_reply_domain =
         std::env::var("QA_REPLY_DOMAIN").unwrap_or_else(|_| mail_domain.clone());
     let webhook_secret = std::env::var("WEBHOOK_SECRET").expect("WEBHOOK_SECRET must be set");
+    let listen_address =
+        std::env::var("QA_LISTEN_ADDRESS").unwrap_or_else(|_| "127.0.0.1".to_string());
+    let listen_port = std::env::var("QA_LISTEN_PORT").unwrap_or_else(|_| "3003".to_string());
+    let listen_target = format!("{listen_address}:{listen_port}");
 
     let conn = Connection::open(&db_path)?;
     conn.execute_batch("PRAGMA journal_mode=WAL;")?;
@@ -58,8 +62,8 @@ pub async fn run() -> Result<(), Box<dyn std::error::Error>> {
         .layer(CorsLayer::permissive())
         .with_state(state);
 
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:3003").await?;
-    println!("Listening on 127.0.0.1:3003");
+    let listener = tokio::net::TcpListener::bind(&listen_target).await?;
+    println!("Listening on {listen_target}");
     axum::serve(listener, app).await?;
     Ok(())
 }
diff --git a/module.nix b/module.nix
index fad860f..1b5dba7 100644
--- a/module.nix
+++ b/module.nix
@@ -253,6 +253,8 @@ in
           "QA_NOTIFY_EMAIL=${cfg.qaNotifyEmail}"
           "QA_MAIL_DOMAIN=${cfg.qaMailDomain}"
           "QA_REPLY_DOMAIN=${cfg.qaReplyDomain}"
+          "QA_LISTEN_ADDRESS=${cfg.apiListenAddress}"
+          "QA_LISTEN_PORT=${toString cfg.apiListenPort}"
         ];
         NoNewPrivileges = true;
         PrivateTmp = true;