diff --git a/devenv b/devenv
index bdb3a46a..3e5018d5 100755
--- a/devenv
+++ b/devenv
@@ -508,6 +508,12 @@ setup_environment() {
     if [ "$use_gotenberg" = "yes" ]; then
         compose_file="docker/development/docker-compose.${db_type}.gotenberg.yml"
         print_success "Using Gotenberg-enabled compose file"
+        # The compose file sets PDF_DRIVER, GOTENBERG_HOST and
+        # GOTENBERG_ALLOWED_PRIVATE_HOST on the php-fpm service, so the sidecar
+        # works with no .env editing. Say so, because the last one exists to let
+        # a private host past the SSRF guard and that is worth knowing about.
+        print_info "PDF driver preconfigured: gotenberg via http://pdf:3000" >&2
+        print_info "The compose file exempts that host from the SSRF guard (GOTENBERG_ALLOWED_PRIVATE_HOST)." >&2
     else
         compose_file="docker/development/docker-compose.${db_type}.yml"
         print_success "Using standard compose file"
diff --git a/docker/development/docker-compose.mysql.gotenberg.yml b/docker/development/docker-compose.mysql.gotenberg.yml
index ec6712f2..fdef9876 100644
--- a/docker/development/docker-compose.mysql.gotenberg.yml
+++ b/docker/development/docker-compose.mysql.gotenberg.yml
@@ -8,6 +8,13 @@ services:
         - UID=${USRID:-1000}
         - GID=${GRPID:-1000}
       target: development
+    environment:
+      # Gotenberg runs as the `pdf` service below, on this compose network, so
+      # its host resolves to a private address. PrivateNetworkGuard rejects those
+      # by default — naming the exact host is what exempts it, and only it.
+      - PDF_DRIVER=gotenberg
+      - GOTENBERG_HOST=http://pdf:3000
+      - GOTENBERG_ALLOWED_PRIVATE_HOST=http://pdf:3000
     volumes:
       - ../../:/var/www/html
     networks:
diff --git a/docker/development/docker-compose.pgsql.gotenberg.yml b/docker/development/docker-compose.pgsql.gotenberg.yml
index 435fbbd9..cf67f3b3 100644
--- a/docker/development/docker-compose.pgsql.gotenberg.yml
+++ b/docker/development/docker-compose.pgsql.gotenberg.yml
@@ -8,6 +8,13 @@ services:
         - UID=${USRID:-1000}
         - GID=${GRPID:-1000}
       target: development
+    environment:
+      # Gotenberg runs as the `pdf` service below, on this compose network, so
+      # its host resolves to a private address. PrivateNetworkGuard rejects those
+      # by default — naming the exact host is what exempts it, and only it.
+      - PDF_DRIVER=gotenberg
+      - GOTENBERG_HOST=http://pdf:3000
+      - GOTENBERG_ALLOWED_PRIVATE_HOST=http://pdf:3000
     volumes:
       - ../../:/var/www/html
     networks:
diff --git a/docker/development/docker-compose.sqlite.gotenberg.yml b/docker/development/docker-compose.sqlite.gotenberg.yml
index f612665d..0bc7ae13 100644
--- a/docker/development/docker-compose.sqlite.gotenberg.yml
+++ b/docker/development/docker-compose.sqlite.gotenberg.yml
@@ -8,6 +8,13 @@ services:
         - UID=${USRID:-1000}
         - GID=${GRPID:-1000}
       target: development
+    environment:
+      # Gotenberg runs as the `pdf` service below, on this compose network, so
+      # its host resolves to a private address. PrivateNetworkGuard rejects those
+      # by default — naming the exact host is what exempts it, and only it.
+      - PDF_DRIVER=gotenberg
+      - GOTENBERG_HOST=http://pdf:3000
+      - GOTENBERG_ALLOWED_PRIVATE_HOST=http://pdf:3000
     volumes:
       - ../../:/var/www/html
     networks: