diff --git a/rootstock/bamboo/node.conf b/rootstock/bamboo/node.conf
index f41f1386..bbc9ee7d 100644
--- a/rootstock/bamboo/node.conf
+++ b/rootstock/bamboo/node.conf
@@ -11,7 +11,9 @@ rpc {
             http = {
                 enabled = true
                 bind_address = "0.0.0.0"
-                hosts = ["*"]
+                # Whitelist: include localhost variants AND the public domain.
+                # ${?DOMAIN} is HOCON env-var sub: skipped if env var is unset.
+                hosts = ["localhost", "127.0.0.1", "::1", ${?DOMAIN}]
                 port = 8545
             }
             ws = {
diff --git a/rootstock/mainnet/node.conf b/rootstock/mainnet/node.conf
index 8c0d3f43..70e61817 100644
--- a/rootstock/mainnet/node.conf
+++ b/rootstock/mainnet/node.conf
@@ -11,7 +11,9 @@ rpc {
             http = {
                 enabled = true
                 bind_address = "0.0.0.0"
-                hosts = ["*"]
+                # Whitelist: include localhost variants AND the public domain.
+                # ${?DOMAIN} is HOCON env-var sub: skipped if env var is unset.
+                hosts = ["localhost", "127.0.0.1", "::1", ${?DOMAIN}]
                 port = 8545
             }
             ws = {
diff --git a/rootstock/rskj/rootstock-bamboo-rskj-archive.yml b/rootstock/rskj/rootstock-bamboo-rskj-archive.yml
index 341811ef..221b4aba 100644
--- a/rootstock/rskj/rootstock-bamboo-rskj-archive.yml
+++ b/rootstock/rskj/rootstock-bamboo-rskj-archive.yml
@@ -52,6 +52,7 @@ services:
       - 8545
       - 8546
     environment:
+      DOMAIN: ${DOMAIN}
       RSKJ_SYS_PROPS: -Drpc.providers.web.http.bind_address=0.0.0.0
     restart: unless-stopped
     stop_grace_period: 5m
diff --git a/rootstock/rskj/rootstock-mainnet-rskj-archive.yml b/rootstock/rskj/rootstock-mainnet-rskj-archive.yml
index c1706eaf..bd40bd0b 100644
--- a/rootstock/rskj/rootstock-mainnet-rskj-archive.yml
+++ b/rootstock/rskj/rootstock-mainnet-rskj-archive.yml
@@ -52,6 +52,7 @@ services:
       - 8545
       - 8546
     environment:
+      DOMAIN: ${DOMAIN}
       RSKJ_SYS_PROPS: -Drpc.providers.web.http.bind_address=0.0.0.0
     restart: unless-stopped
     stop_grace_period: 5m