diff --git a/scripts/addons/codeserver/install.sh b/scripts/addons/codeserver/install.sh
index a9a01f8..2b5d7f5 100644
--- a/scripts/addons/codeserver/install.sh
+++ b/scripts/addons/codeserver/install.sh
@@ -18,6 +18,8 @@ WORKSPACE_DIR="${CODE_SERVER_WORKSPACE:-/home/dev/workspace}"
 PORT="${CODE_SERVER_PORT:-8080}"
 BIN="${SERVICE_ROOT}/bin/code-server"
 LINK_PATH="/usr/local/bin/code-server"
+CONFIG_DIR="/home/dev/.config/code-server"
+CONFIG_FILE="${CONFIG_DIR}/config.yaml"
 
 mkdir -p "$(dirname "${MARKER}")"
 mkdir -p "$(dirname "${LOG_FILE}")"
@@ -78,6 +80,18 @@ validate_artifact_shape() {
   fi
 }
 
+write_config() {
+  mkdir -p "${CONFIG_DIR}"
+  cat > "${CONFIG_FILE}" <<EOF
+bind-addr: 0.0.0.0:${PORT}
+auth: none
+disable-telemetry: true
+proxy-domain: ""
+EOF
+  chown -R dev:dev "${CONFIG_DIR}" 2>/dev/null || true
+  echo "[code-server] action=config_write path=${CONFIG_FILE} status=ok"
+}
+
 # ----------------------------------------------------------
 # Idempotency
 # ----------------------------------------------------------
@@ -93,14 +107,15 @@ if [ ! -x "${BIN}" ]; then
 fi
 
 mkdir -p "${WORKSPACE_DIR}"
+write_config
 
 if [ -f "${PID_FILE}" ] && kill -0 "$(cat "${PID_FILE}")" 2>/dev/null; then
   echo "[code-server] already running"
 else
   rm -f "${PID_FILE}"
-  echo "[code-server] action=service_launch command=\"${BIN} --bind-addr 0.0.0.0:${PORT} --auth none --disable-telemetry --allowed-hosts all ${WORKSPACE_DIR}\""
+  echo "[code-server] action=service_launch command=\"${BIN} --bind-addr 0.0.0.0:${PORT} --auth none --disable-telemetry ${WORKSPACE_DIR}\""
   HOME="/home/dev" USER="dev" LOGNAME="dev" \
-    nohup "${BIN}" --bind-addr "0.0.0.0:${PORT}" --auth none --disable-telemetry --allowed-hosts all "${WORKSPACE_DIR}" >"${LOG_FILE}" 2>&1 &
+    nohup "${BIN}" --bind-addr "0.0.0.0:${PORT}" --auth none --disable-telemetry "${WORKSPACE_DIR}" >"${LOG_FILE}" 2>&1 &
   echo $! > "${PID_FILE}"
 fi