diff --git a/packages/node-modules-inspector/src/node/cli.ts b/packages/node-modules-inspector/src/node/cli.ts
index e2b4408b..f7de0f5f 100644
--- a/packages/node-modules-inspector/src/node/cli.ts
+++ b/packages/node-modules-inspector/src/node/cli.ts
@@ -118,9 +118,10 @@ cli
   .option('--host <host>', 'Host', { default: process.env.HOST || '127.0.0.1' })
   .option('--port <port>', 'Port', { default: process.env.PORT || 9999 })
   .option('--open', 'Open browser', { default: true })
-  .option('--auth', 'Require the one-time-code auth handshake before RPC calls', { default: true })
+  .option('--auth', 'Require the one-time-code auth handshake before RPC calls')
   .action(async (options) => {
     const host = options.host
+    const auth = options.auth ?? (host === '0.0.0.0' || host === '::')
     const port = await resolveDevServerPort(devframe, {
       host,
       defaultPort: Number(options.port),
@@ -137,9 +138,8 @@ cli
         config: options.config,
         depth: Number(options.depth),
         // Forwarded to createDevServer's own auth resolution (not consumed by
-        // devframe.setup) — `--no-auth` opts out of the interactive OTP gate
-        // for trusted automation (e.g. the e2e suite driving a headless browser).
-        auth: options.auth,
+        // devframe.setup). Explicit --auth/--no-auth override the host default.
+        auth,
       },
       openBrowser: options.open ? url : false,
     })
diff --git a/test/e2e/utils/orchestrate.mjs b/test/e2e/utils/orchestrate.mjs
index bac3d1c6..2ba934d1 100644
--- a/test/e2e/utils/orchestrate.mjs
+++ b/test/e2e/utils/orchestrate.mjs
@@ -144,11 +144,7 @@ async function startServers() {
   start(
     'dev',
     'node',
-    // `--no-auth` skips devframe's interactive OTP handshake — a headless
-    // Playwright browser can't complete the "open the printed magic link"
-    // step, and the RPC calls the SPA makes on load would otherwise be
-    // rejected as untrusted (DF0036).
-    ['packages/node-modules-inspector/bin.mjs', '--port', String(PORT_DEV), '--host', '127.0.0.1', '--no-open', '--no-auth'],
+    ['packages/node-modules-inspector/bin.mjs', '--port', String(PORT_DEV), '--host', '127.0.0.1', '--no-open'],
   )
   start(
     'build',