diff --git a/vite.config.ts b/vite.config.ts
index 6bc092a..387773d 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -1,5 +1,5 @@
 import { tanstackStart } from "@tanstack/react-start/plugin/vite";
-import { defineConfig } from "vite";
+import { defineConfig, loadEnv } from "vite";
 import tsConfigPaths from "vite-tsconfig-paths";
 import viteReact from "@vitejs/plugin-react";
 import tailwindcss from "@tailwindcss/vite";
@@ -7,19 +7,27 @@ import { cloudflare } from "@cloudflare/vite-plugin";
 import { devtools } from "@tanstack/devtools-vite";
 import { leanWorkerBundle } from "./vite-plugin-lean-worker-bundle";
 
-export default defineConfig(() => {
+export default defineConfig(({ mode }) => {
   // PORT/ALLOWED_HOST are documented self-host knobs (SELF_HOSTING_DOCKER.md,
   // compose.yaml) but were never actually read here — every deployment was
   // silently stuck on port 3001 and this one hardcoded domain, breaking any
   // second instance on a different domain or port. Defaults keep existing
   // deployments that don't set these working exactly as before.
-  const port = Number(process.env.PORT) || 3001;
+  //
+  // Read via Vite's own loadEnv(), not bare process.env: process.env inside
+  // this config function only sees whatever the OS process environment
+  // already has (e.g. exported by the shell or pm2's ecosystem file) —
+  // Vite's .env-file loading (envPrefix below) only reaches import.meta.env
+  // in app code, not this function. loadEnv reads the same .env files Vite
+  // always has, regardless of how the process was launched.
+  const env = loadEnv(mode, process.cwd(), "");
+  const port = Number(env.PORT) || 3001;
 
   const showDevtools = false;
 
   const allowedHosts = [
     "seo.thedomainnest.com",
-    process.env.ALLOWED_HOST,
+    env.ALLOWED_HOST,
   ].filter((host): host is string => Boolean(host));
 
   return {