diff --git a/README.md b/README.md
index 04ff8fa1e..0e04ccae4 100644
--- a/README.md
+++ b/README.md
@@ -242,7 +242,7 @@ docker compose -f docker/docker-compose.yml --profile launcher up -d
 # Open http://localhost:18800
 ```
 
-> **Docker / VM users:** The Gateway listens on `127.0.0.1` by default. Set `PICOCLAW_GATEWAY_HOST=0.0.0.0` or use the `-public` flag to make it accessible from the host. If loopback bind fails at runtime, PicoClaw may fallback to `0.0.0.0` with CIDR restrictions; configure `gateway.allowed_cidrs` to keep exposure limited.
+> **Docker / VM users:** The Gateway listens on `127.0.0.1` by default. Set `PICOCLAW_GATEWAY_HOST=0.0.0.0` or use the `-public` flag to make it accessible from the host. If loopback bind fails at runtime, PicoClaw may fallback to wildcard bind addresses (`0.0.0.0` for IPv4 or `::` for IPv6) with CIDR restrictions; configure `gateway.allowed_cidrs` to keep exposure limited.
 
 ```bash
 # Check logs
diff --git a/docs/configuration.md b/docs/configuration.md
index 49b8329f0..831bf316b 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -55,7 +55,7 @@ You can also override this with the environment variable `PICOCLAW_LOG_LEVEL`.
 
 When `gateway.host` is a loopback address (`127.0.0.1`, `::1`, or `localhost`) and bind fails (for example, on boards where loopback is unavailable), PicoClaw automatically:
 
-1. Falls back to bind on `0.0.0.0`.
+1. Falls back to a wildcard bind on all interfaces, using either `0.0.0.0` (IPv4) or `::` (IPv6), depending on whether the configured loopback host is IPv4/IPv6/`localhost` and which wildcard bind succeeds.
 2. Enforces a CIDR allowlist for gateway HTTP endpoints.
 3. Discovers private local interface CIDRs only when `gateway.allowed_cidrs` is empty.
 
diff --git a/docs/docker.md b/docs/docker.md
index 16c9e89f2..874c72371 100644
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -27,7 +27,7 @@ docker compose -f docker/docker-compose.yml --profile gateway up -d
 > **Docker Users**: By default, the Gateway listens on `127.0.0.1` which is not accessible from the host. If you need to access the health endpoints or expose ports, set `PICOCLAW_GATEWAY_HOST=0.0.0.0` in your environment or update `config.json`.
 
 > [!TIP]
-> If `gateway.host` is loopback and bind fails at runtime (for example, loopback unavailable on some boards), PicoClaw will fallback to `0.0.0.0` and enforce CIDR restrictions. Configure `gateway.allowed_cidrs` to keep exposure limited to trusted networks.
+> If `gateway.host` is loopback and bind fails at runtime (for example, loopback unavailable on some boards), PicoClaw may fall back to `0.0.0.0` and/or `::` (IPv4/IPv6 wildcard) and will enforce CIDR restrictions. Configure `gateway.allowed_cidrs` to keep exposure limited to trusted networks.
 
 > [!NOTE]
 > The `gateway` profile only serves the webhook handlers (including Pico when enabled) and health endpoints on the gateway port, so it does not expose generic REST chat endpoints such as `/chat` or `/a2a`. Launcher mode adds the browser UI plus `/api/pico/token` and a `/pico/ws` proxy on the launcher port, but `/pico/ws` is also available directly on the gateway whenever the Pico channel is enabled.