diff --git a/src/commands/dashboard.ts b/src/commands/dashboard.ts
index deef3458388..0fa8cef20be 100644
--- a/src/commands/dashboard.ts
+++ b/src/commands/dashboard.ts
@@ -20,14 +20,15 @@ export async function dashboardCommand(
   const snapshot = await readConfigFileSnapshot();
   const cfg = snapshot.valid ? snapshot.config : {};
   const port = resolveGatewayPort(cfg);
-  const bind = cfg.gateway?.bind ?? "loopback";
   const basePath = cfg.gateway?.controlUi?.basePath;
   const customBindHost = cfg.gateway?.customBindHost;
   const token = cfg.gateway?.auth?.token ?? process.env.OPENCLAW_GATEWAY_TOKEN ?? "";
 
+  // Dashboard always uses localhost regardless of bind mode to avoid
+  // secure context errors in browsers (which require HTTPS or localhost)
   const links = resolveControlUiLinks({
     port,
-    bind,
+    bind: "loopback",
     customBindHost,
     basePath,
   });