diff --git a/daemon/main.ts b/daemon/main.ts
index 3de202b2b..89dc0e9a6 100644
--- a/daemon/main.ts
+++ b/daemon/main.ts
@@ -148,6 +148,14 @@ if (SANDBOX_MODE) {
   );
 }
 
+// Surface scheduled-restart configuration so it's easy to rule out as the cause
+// of "the daemon keeps restarting" reports.
+console.log(
+  `[daemon] ${UNSTABLE_WORKER_RESPAWN_INTERVAL_MS_ENV_NAME}=${
+    UNSTABLE_WORKER_RESPAWN_INTERVAL_MS ?? "unset"
+  }`,
+);
+
 globalThis.addEventListener(
   "unhandledrejection",
   (e: { promise: Promise<unknown>; reason: unknown }) => {
diff --git a/daemon/meta.ts b/daemon/meta.ts
index aa2e4d21f..f9f2be1ff 100644
--- a/daemon/meta.ts
+++ b/daemon/meta.ts
@@ -131,6 +131,10 @@ export const watchMeta = async (signal?: AbortSignal) => {
 
       dispatchWorkerState("updating");
       console.error(error);
+      // Backoff to avoid a tight retry spin when the worker fetch fails fast
+      // (e.g. connection refused mid-restart); without this, the loop pegs CPU
+      // and floods stderr until a supervisor kills the daemon.
+      await new Promise((resolve) => setTimeout(resolve, 1000));
     }
   }
 
diff --git a/daemon/workers/denoRun.ts b/daemon/workers/denoRun.ts
index ca31b467d..e199d12ae 100644
--- a/daemon/workers/denoRun.ts
+++ b/daemon/workers/denoRun.ts
@@ -82,7 +82,9 @@ export class DenoRun implements Isolate {
         },
       });
     }
-    const hostname = Deno.build.os === "windows" ? "localhost" : "0.0.0.0";
+    // 127.0.0.1 is the correct loopback for outbound connections;
+    // 0.0.0.0 is a bind wildcard and not a valid connect target on macOS/Linux.
+    const hostname = Deno.build.os === "windows" ? "localhost" : "127.0.0.1";
     this.proxyUrl = `http://${hostname}:${this.port}`;
     this.client = typeof Deno.createHttpClient === "function"
       ? Deno.createHttpClient({