diff --git a/mcp/server.php b/mcp/server.php
index bc97d74..e9e2dca 100644
--- a/mcp/server.php
+++ b/mcp/server.php
@@ -48,6 +48,15 @@ if (empty($resourceUrl) || empty($issuer)) {
 $psr17 = new Psr17Factory();
 $request = (new ServerRequestCreator($psr17, $psr17, $psr17, $psr17))->fromGlobals();
 
+// ServerRequestCreator adds Host both from the URI and from the request
+// headers, so getHeaderLine('Host') comes back as "h, h" under PHP-FPM, which
+// the DNS-rebinding check below then rejects. Collapse to the single value the
+// client actually sent.
+$clientHost = $request->getHeader('Host')[0] ?? '';
+if ($clientHost !== '') {
+    $request = $request->withHeader('Host', $clientHost);
+}
+
 // TLS terminates at the reverse proxy, so PHP sees plain http and a Host header
 // the client controls. The SDK derives the resource_metadata URL in its 401
 // challenge from the request URI, so pin scheme/host/port to the configured