diff --git a/docs/how-it-works/gateways/configuration.mdx b/docs/how-it-works/gateways/configuration.mdx
index 10426fee1..a8df10baf 100644
--- a/docs/how-it-works/gateways/configuration.mdx
+++ b/docs/how-it-works/gateways/configuration.mdx
@@ -966,6 +966,8 @@ uses `host.docker.internal` on Desktop or with a wildcard listener, otherwise
 the Linux listener's non-loopback address. Both use the gateway's bind port.
 Bridge requires a reachable listener; OpenShell does not widen it. Set an
 explicit endpoint for remapped ports. HTTPS certificates must cover the endpoint.
+The local `gateway:docker` task uses automatic endpoint selection unless you set
+`OPENSHELL_GRPC_ENDPOINT`.
 
 Bridge resolves both host aliases through Docker's `host-gateway`; native Linux
 services bound only to loopback remain unreachable. Desktop host mode requires
diff --git a/skills/debug-openshell-cluster/SKILL.md b/skills/debug-openshell-cluster/SKILL.md
index 6b09ba1a9..681f36607 100644
--- a/skills/debug-openshell-cluster/SKILL.md
+++ b/skills/debug-openshell-cluster/SKILL.md
@@ -301,7 +301,9 @@ Common findings:
   feature is enabled. Bridge mode uses `host.docker.internal` for the Desktop
   host and requires a bridge-reachable listener on native Linux. Explicit
   `grpc_endpoint` values must be reachable in the selected mode, including any
-  remapped published port, with matching TLS certificate names. Mode selection
+  remapped published port, with matching TLS certificate names. The local
+  `gateway:docker` task discovers its endpoint unless `OPENSHELL_GRPC_ENDPOINT`
+  supplies an override. Mode selection
   does not bypass Landlock/seccomp qualification. A gateway container under ECI
   also needs an administrator-approved Docker socket exception. See the
   published [Docker configuration](https://docs.nvidia.com/openshell/latest/how-it-works/gateways/configuration.md)
diff --git a/tasks/scripts/gateway-docker.sh b/tasks/scripts/gateway-docker.sh
index 9974cb8a0..8daa16a89 100644
--- a/tasks/scripts/gateway-docker.sh
+++ b/tasks/scripts/gateway-docker.sh
@@ -146,8 +146,6 @@ ensure_docker_runtime_image \
   sandbox \
   "sandbox runtime"
 
-GRPC_ENDPOINT="${OPENSHELL_GRPC_ENDPOINT:-http://127.0.0.1:${PORT}}"
-
 CARGO_BUILD_JOBS_ARG=()
 if [[ -n "${CARGO_BUILD_JOBS:-}" ]]; then
   CARGO_BUILD_JOBS_ARG=(-j "${CARGO_BUILD_JOBS}")
@@ -191,12 +189,15 @@ supervisor_image = "${SUPERVISOR_IMAGE}"
 sandbox_runtime_image = "${SANDBOX_RUNTIME_IMAGE}"
 image_pull_policy = "${SANDBOX_IMAGE_PULL_POLICY}"
 sandbox_label = "${SANDBOX_NAMESPACE}"
-grpc_endpoint = "${GRPC_ENDPOINT}"
 # Explicit supervisor-compatible default. Set RuntimeDefault or
 # Localhost/<profile> only on a Docker host with AppArmor enabled.
 app_armor_profile = "Unconfined"
 EOF
 
+if [[ -n "${OPENSHELL_GRPC_ENDPOINT:-}" ]]; then
+  printf 'grpc_endpoint = "%s"\n' "$(toml_escape "${OPENSHELL_GRPC_ENDPOINT}")" >>"${CONFIG_PATH}"
+fi
+
 # Keep the local task's proxy inputs aligned with [openshell.drivers.docker].
 # Credentials stay in the referenced root-owned file; do not echo their value.
 if [[ -n "${OPENSHELL_SANDBOX_HTTPS_PROXY+x}" ]]; then