diff --git a/Cargo.lock b/Cargo.lock
index fb51fec..4ce2755 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1968,7 +1968,7 @@ dependencies = [
 
 [[package]]
 name = "secrets-mcp"
-version = "0.3.8"
+version = "0.3.9"
 dependencies = [
  "anyhow",
  "askama",
diff --git a/crates/secrets-mcp/Cargo.toml b/crates/secrets-mcp/Cargo.toml
index 387d6a7..b1eed8c 100644
--- a/crates/secrets-mcp/Cargo.toml
+++ b/crates/secrets-mcp/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "secrets-mcp"
-version = "0.3.8"
+version = "0.3.9"
 edition.workspace = true
 
 [[bin]]
diff --git a/crates/secrets-mcp/src/main.rs b/crates/secrets-mcp/src/main.rs
index b62486c..134823b 100644
--- a/crates/secrets-mcp/src/main.rs
+++ b/crates/secrets-mcp/src/main.rs
@@ -40,6 +40,14 @@ fn load_env_var(name: &str) -> Option<String> {
     std::env::var(name).ok().filter(|s| !s.is_empty())
 }
 
+/// Pretty-print bind address in logs (`127.0.0.1` → `localhost`); actual socket bind unchanged.
+fn listen_addr_log_display(bind_addr: &str) -> String {
+    bind_addr
+        .strip_prefix("127.0.0.1:")
+        .map(|port| format!("localhost:{port}"))
+        .unwrap_or_else(|| bind_addr.to_string())
+}
+
 fn load_oauth_config(prefix: &str, base_url: &str, path: &str) -> Option<OAuthConfig> {
     let client_id = load_env_var(&format!("{}_CLIENT_ID", prefix))?;
     let client_secret = load_env_var(&format!("{}_CLIENT_SECRET", prefix))?;
@@ -168,7 +176,10 @@ async fn main() -> Result<()> {
         .await
         .with_context(|| format!("failed to bind to {}", bind_addr))?;
 
-    tracing::info!("Secrets MCP Server listening on http://{}", bind_addr);
+    tracing::info!(
+        "Secrets MCP Server listening on http://{}",
+        listen_addr_log_display(&bind_addr)
+    );
     tracing::info!("MCP endpoint: {}/mcp", base_url);
 
     axum::serve(