@@ -81,11 +81,21 @@ fn generate_confirmation_code() -> String {
     code
 }
 
-/// Build the gateway `/auth/connect` URL carrying the local callback port
-/// and the one-time confirmation code.
-fn auth_connect_url(gateway_endpoint: &str, callback_port: u16, code: &str) -> String {
+/// Build the gateway `/auth/connect` URL carrying the local callback host
+/// and port plus the one-time confirmation code.
+///
+/// `callback_host` is the unbracketed IP literal the browser should use to
+/// reach the CLI callback server (for example `127.0.0.1` or `::1`). The
+/// gateway page brackets IPv6 literals when building the fetch URL and only
+/// accepts loopback addresses.
+fn auth_connect_url(
+    gateway_endpoint: &str,
+    callback_host: &str,
+    callback_port: u16,
+    code: &str,
+) -> String {
     format!(
-        "{}/auth/connect?callback_port={callback_port}&code={code}",
+        "{}/auth/connect?callback_port={callback_port}&callback_host={callback_host}&code={code}",
         gateway_endpoint.trim_end_matches('/')
     )
 }
@@ -123,10 +133,11 @@ pub async fn browser_auth_flow(gateway_endpoint: &str) -> Result<String> {
     let listener = crate::callback::bind_callback_listener().await?;
     let local_addr = listener.local_addr().into_diagnostic()?;
     let callback_port = local_addr.port();
+    let callback_host = crate::callback::callback_target(local_addr).to_string();
 
     let code = generate_confirmation_code();
 
-    let auth_url = auth_connect_url(gateway_endpoint, callback_port, &code);
+    let auth_url = auth_connect_url(gateway_endpoint, &callback_host, callback_port, &code);
 
     // Channel to receive the token from the callback handler.
     let (tx, rx) = oneshot::channel::<String>();
@@ -892,7 +903,7 @@ mod tests {
 
     use crate::callback::{CALLBACK_BIND_ADDRESS_ENV, CALLBACK_PORT_ENV};
     use crate::test_utils::Environment;
-    use std::net::{IpAddr, Ipv4Addr};
+    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
     /// Bind an ephemeral loopback listener, return its (now freed) port.
     async fn free_loopback_port() -> u16 {
@@ -923,11 +934,12 @@ mod tests {
 
                 assert_eq!(addr.ip(), IpAddr::V4(Ipv4Addr::LOCALHOST));
                 assert_ne!(addr.port(), 0);
-                let url = auth_connect_url(TEST_GATEWAY, addr.port(), "ABC-1234");
+                let url = auth_connect_url(TEST_GATEWAY, "127.0.0.1", addr.port(), "ABC-1234");
                 assert!(
                     url.contains(&format!("callback_port={}", addr.port())),
                     "auth URL: {url}"
                 );
+                assert!(url.contains("callback_host=127.0.0.1"), "auth URL: {url}");
             })
             .await;
     }
@@ -947,13 +959,37 @@ mod tests {
 
                 assert_eq!(addr.ip(), IpAddr::V4(Ipv4Addr::UNSPECIFIED));
                 assert_eq!(addr.port(), expected);
-                // The gateway auth URL advertises the fixed port so the wrapper's
-                // published `-p 127.0.0.1:<port>:<port>` mapping reaches the listener.
-                let url = auth_connect_url(TEST_GATEWAY, addr.port(), "ABC-1234");
+                // The gateway auth URL advertises the fixed port and the
+                // IPv4 loopback target so the wrapper's published
+                // `-p 127.0.0.1:<port>:<port>` mapping reaches the listener.
+                let url = auth_connect_url(TEST_GATEWAY, "127.0.0.1", addr.port(), "ABC-1234");
                 assert!(
                     url.contains(&format!("callback_port={expected}")),
                     "auth URL: {url}"
                 );
+                assert!(url.contains("callback_host=127.0.0.1"), "auth URL: {url}");
+            })
+            .await;
+    }
+
+    #[tokio::test]
+    async fn browser_flow_advertises_ipv6_loopback_callback_host() {
+        Environment::new()
+            .remove(CALLBACK_PORT_ENV)
+            .set(CALLBACK_BIND_ADDRESS_ENV, "::1")
+            .run_async(async {
+                let listener = crate::callback::bind_callback_listener()
+                    .await
+                    .expect("ipv6 bind");
+                let addr = listener.local_addr().expect("local addr");
+
+                assert_eq!(addr.ip(), IpAddr::V6(Ipv6Addr::LOCALHOST));
+                // The auth URL carries the unbracketed IPv6 literal; the
+                // gateway page brackets it when building the fetch URL.
+                let host = crate::callback::callback_target(addr).to_string();
+                assert_eq!(host, "::1");
+                let url = auth_connect_url(TEST_GATEWAY, &host, addr.port(), "ABC-1234");
+                assert!(url.contains("callback_host=::1"), "auth URL: {url}");
             })
             .await;
     }
 
@@ -20,15 +20,17 @@
 //!   runtimes with user-mode networking (pasta, slirp4netns) can only reach
 //!   listeners bound to `0.0.0.0`, so a wrapper sets this to `0.0.0.0`
 //!   inside the container while publishing the port to host loopback only.
-//!   The browser-facing redirect URL stays `http://127.0.0.1:<port>/...`
-//!   either way, so no identity-provider allowlist change is needed.
+//!   IPv6 addresses work too (for example `::1` or `::`): the browser-facing
+//!   callback URL derives from the bound address (see [`callback_host`]), so
+//!   an IPv6-bound listener directs the browser to `http://[::1]:<port>/...`
+//!   instead of the unreachable `127.0.0.1`.
 //!
 //! Both variables default to unset, preserving the historical
 //! `127.0.0.1:<ephemeral>` behavior. Binding `0.0.0.0` on a host machine
 //! would expose the callback server to the local network, so it is never the
 //! default and always requires the explicit variable.
 
-use std::net::{IpAddr, Ipv4Addr, SocketAddr};
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
 
 use miette::Result;
 use tokio::net::TcpListener;
@@ -67,6 +69,33 @@ pub(crate) async fn bind_callback_listener() -> Result<TcpListener> {
         .map_err(|e| bind_error(addr, e))
 }
 
+/// The IP address a browser uses to reach a bound callback listener.
+///
+/// Callback URLs target the bound address, except that wildcard binds are
+/// reached through the matching loopback address: a listener on `0.0.0.0`
+/// accepts `127.0.0.1` connections and a listener on `::` accepts `::1`
+/// connections, so the browser is sent to the loopback literal of that
+/// family (the container wrapper publishes the port to host loopback).
+pub(crate) fn callback_target(local_addr: SocketAddr) -> IpAddr {
+    match local_addr.ip() {
+        IpAddr::V4(v4) if v4.is_unspecified() => IpAddr::V4(Ipv4Addr::LOCALHOST),
+        IpAddr::V6(v6) if v6.is_unspecified() => IpAddr::V6(Ipv6Addr::LOCALHOST),
+        ip => ip,
+    }
+}
+
+/// The host a browser uses to reach a bound callback listener, in URL form.
+///
+/// IPv4 addresses render bare (`127.0.0.1`); IPv6 addresses are bracketed
+/// (`[::1]`) as required by RFC 3986/RFC 8252. Use
+/// [`callback_target`] for the unbracketed literal.
+pub(crate) fn callback_host(local_addr: SocketAddr) -> String {
+    match callback_target(local_addr) {
+        IpAddr::V4(v4) => v4.to_string(),
+        IpAddr::V6(v6) => format!("[{v6}]"),
+    }
+}
+
 /// Parse and validate [`CALLBACK_PORT_ENV`].
 fn parse_callback_port(raw: &str) -> Result<u16> {
     let invalid = || {
@@ -108,7 +137,6 @@ fn bind_error(addr: SocketAddr, source: std::io::Error) -> miette::Report {
 mod tests {
     use super::*;
     use crate::test_utils::Environment;
-    use std::net::Ipv6Addr;
 
     /// Bind an ephemeral loopback listener, return its (now freed) port.
     async fn free_loopback_port() -> u16 {
@@ -159,6 +187,67 @@ mod tests {
         }
     }
 
+    #[test]
+    fn callback_host_maps_bindings_to_reachable_url_hosts() {
+        let parse = |s: &str| -> SocketAddr { s.parse().expect("addr") };
+        // Wildcard binds are reached through the matching loopback literal.
+        assert_eq!(callback_host(parse("0.0.0.0:8080")), "127.0.0.1");
+        assert_eq!(callback_host(parse("[::]:8080")), "[::1]");
+        // Loopback binds keep their address; IPv6 renders bracketed.
+        assert_eq!(callback_host(parse("127.0.0.1:8080")), "127.0.0.1");
+        assert_eq!(callback_host(parse("[::1]:8080")), "[::1]");
+        // Explicit specific addresses are addressed literally.
+        assert_eq!(callback_host(parse("192.168.1.5:8080")), "192.168.1.5");
+        assert_eq!(callback_host(parse("[2001:db8::5]:8080")), "[2001:db8::5]");
+    }
+
+    #[test]
+    fn callback_target_maps_bindings_to_reachable_ips() {
+        let parse = |s: &str| -> SocketAddr { s.parse().expect("addr") };
+        assert_eq!(
+            callback_target(parse("0.0.0.0:8080")),
+            IpAddr::V4(Ipv4Addr::LOCALHOST)
+        );
+        assert_eq!(
+            callback_target(parse("[::]:8080")),
+            IpAddr::V6(Ipv6Addr::LOCALHOST)
+        );
+        assert_eq!(
+            callback_target(parse("[2001:db8::5]:8080")),
+            IpAddr::V6("2001:db8::5".parse::<Ipv6Addr>().expect("v6"))
+        );
+    }
+
+    #[tokio::test]
+    async fn ipv6_callback_is_reachable_at_advertised_host() {
+        // Callback reachability: an IPv6-bound listener must be reachable at
+        // exactly the host the browser flows advertise, and (on a host
+        // without the address) must NOT be reachable via IPv4 loopback.
+        Environment::new()
+            .remove(CALLBACK_PORT_ENV)
+            .set(CALLBACK_BIND_ADDRESS_ENV, "::1")
+            .run_async(async {
+                let listener = bind_callback_listener().await.expect("ipv6 bind");
+                let addr = listener.local_addr().expect("local addr");
+                let host = callback_host(addr);
+                assert_eq!(host, "[::1]");
+
+                let v6 = SocketAddr::new(
+                    IpAddr::V6("::1".parse::<Ipv6Addr>().expect("v6")),
+                    addr.port(),
+                );
+                let stream = tokio::net::TcpStream::connect(v6)
+                    .await
+                    .expect("[::1] callback must be reachable");
+                drop(stream);
+
+                let v4 = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), addr.port());
+                let refused = tokio::net::TcpStream::connect(v4).await;
+                assert!(refused.is_err(), "IPv4 loopback must not reach a ::1 bind");
+            })
+            .await;
+    }
+
     #[test]
     fn busy_fixed_port_error_names_the_variable() {
         let addr: SocketAddr = "127.0.0.1:18080".parse().expect("parse addr");
 
@@ -173,13 +173,16 @@ fn device_token_form(
 
 /// Build the OIDC redirect URI for a bound callback listener.
 ///
-/// The URI always points at IPv4 loopback, even when the listener binds
-/// `0.0.0.0` inside a container: the host-published port and the identity
-/// provider allowlist (`http://127.0.0.1:*`) both target host loopback. See
-/// the `callback` module docs for the environment-variable controls.
+/// The URI derives from the listener's bound address (see
+/// [`crate::callback::callback_host`]): IPv4 binds and the default bind use
+/// `http://127.0.0.1:<port>/callback`, while IPv6 binds use the bracketed
+/// literal (`http://[::1]:<port>/callback`), matching RFC 8252 loopback
+/// redirects. Identity providers that allowlist `http://127.0.0.1:*` for
+/// native apps should also allowlist `http://[::1]:*`.
 fn callback_redirect_uri(listener: &TcpListener) -> Result<String> {
-    let port = listener.local_addr().into_diagnostic()?.port();
-    Ok(format!("http://127.0.0.1:{port}/callback"))
+    let local_addr = listener.local_addr().into_diagnostic()?;
+    let host = crate::callback::callback_host(local_addr);
+    Ok(format!("http://{host}:{}/callback", local_addr.port()))
 }
 
 /// Run the OIDC Authorization Code + PKCE browser flow.
@@ -1051,7 +1054,7 @@ mod tests {
 
     use crate::callback::{CALLBACK_BIND_ADDRESS_ENV, CALLBACK_PORT_ENV};
     use crate::test_utils::Environment;
-    use std::net::{IpAddr, Ipv4Addr};
+    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
     /// Bind an ephemeral loopback listener, return its (now freed) port.
     async fn free_loopback_port() -> u16 {
@@ -1103,14 +1106,52 @@ mod tests {
 
                 assert_eq!(addr.ip(), IpAddr::V4(Ipv4Addr::UNSPECIFIED));
                 assert_eq!(addr.port(), expected);
-                // The redirect URI stays on 127.0.0.1 even for a wildcard bind so the
-                // identity-provider allowlist keeps matching.
+                // The redirect URI stays on 127.0.0.1 for an IPv4 wildcard
+                // bind so the identity-provider allowlist keeps matching.
                 let uri = callback_redirect_uri(&listener).expect("redirect uri");
                 assert_eq!(uri, format!("http://127.0.0.1:{expected}/callback"));
             })
             .await;
     }
 
+    #[tokio::test]
+    async fn browser_flow_redirect_uri_follows_ipv6_bind() {
+        Environment::new()
+            .remove(CALLBACK_PORT_ENV)
+            .set(CALLBACK_BIND_ADDRESS_ENV, "::1")
+            .run_async(async {
+                let listener = crate::callback::bind_callback_listener()
+                    .await
+                    .expect("ipv6 bind");
+                let addr = listener.local_addr().expect("local addr");
+
+                assert_eq!(addr.ip(), IpAddr::V6(Ipv6Addr::LOCALHOST));
+                // RFC 8252 loopback redirect with the bracketed IPv6 literal,
+                // so the browser actually reaches the ::1-bound listener.
+                let uri = callback_redirect_uri(&listener).expect("redirect uri");
+                assert_eq!(uri, format!("http://[::1]:{}/callback", addr.port()));
+            })
+            .await;
+    }
+
+    #[tokio::test]
+    async fn browser_flow_redirect_uri_uses_ipv6_loopback_for_wildcard_v6_bind() {
+        Environment::new()
+            .remove(CALLBACK_PORT_ENV)
+            .set(CALLBACK_BIND_ADDRESS_ENV, "::")
+            .run_async(async {
+                let listener = crate::callback::bind_callback_listener()
+                    .await
+                    .expect("wildcard ipv6 bind");
+                let addr = listener.local_addr().expect("local addr");
+
+                assert_eq!(addr.ip(), IpAddr::V6(Ipv6Addr::UNSPECIFIED));
+                let uri = callback_redirect_uri(&listener).expect("redirect uri");
+                assert_eq!(uri, format!("http://[::1]:{}/callback", addr.port()));
+            })
+            .await;
+    }
+
     #[tokio::test]
     async fn browser_flow_rejects_invalid_callback_port() {
         Environment::new()