diff --git a/cmd/zrok/access_private.go b/cmd/zrok/access_private.go
index adbb60a6..5d893542 100644
--- a/cmd/zrok/access_private.go
+++ b/cmd/zrok/access_private.go
@@ -33,7 +33,7 @@ func newAccessPrivateCommand() *accessPrivateCommand {
 	}
 	command := &accessPrivateCommand{cmd: cmd}
 	cmd.Run = command.run
-	cmd.Flags().StringVarP(&command.bindAddress, "bind", "b", "0.0.0.0:9191", "The address to bind the private frontend")
+	cmd.Flags().StringVarP(&command.bindAddress, "bind", "b", "127.0.0.1:9191", "The address to bind the private frontend")
 	return command
 }
 
diff --git a/cmd/zrok/test.go b/cmd/zrok/test.go
index 4520e0de..496d784f 100644
--- a/cmd/zrok/test.go
+++ b/cmd/zrok/test.go
@@ -43,7 +43,7 @@ func newTestEndpointCommand() *testEndpointCommand {
 		}
 		panic(err)
 	}
-	cmd.Flags().StringVarP(&command.address, "address", "a", "0.0.0.0", "The address for the HTTP listener")
+	cmd.Flags().StringVarP(&command.address, "address", "a", "127.0.0.1", "The address for the HTTP listener")
 	cmd.Flags().Uint16VarP(&command.port, "port", "P", 9090, "The port for the HTTP listener")
 	cmd.Run = command.run
 	return command