diff --git a/docker/.env.example b/docker/.env.example
index 716405f8e..766f92dcc 100644
--- a/docker/.env.example
+++ b/docker/.env.example
@@ -85,13 +85,20 @@ EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L6-v2
 # ZERO_CVR_DB=postgresql://surfsense:surfsense@db:5432/surfsense
 # ZERO_CHANGE_DB=postgresql://surfsense:surfsense@db:5432/surfsense
 
-# URL where zero-cache sends queries for resolution (server-to-server).
-# Default: http://frontend:3000/api/zero/query (Docker service networking).
+# ZERO_QUERY_URL: where zero-cache forwards query requests for resolution.
+# ZERO_MUTATE_URL: required by zero-cache when auth tokens are used, even though
+#   SurfSense does not use Zero mutators. Setting both URLs tells zero-cache to
+#   skip its own JWT verification and let the app endpoints handle auth instead.
+#   The mutate endpoint is a no-op that returns an empty response.
+# Default: Docker service networking (http://frontend:3000/api/zero/...).
 # Override when running the frontend outside Docker:
 #   ZERO_QUERY_URL=http://host.docker.internal:3000/api/zero/query
+#   ZERO_MUTATE_URL=http://host.docker.internal:3000/api/zero/mutate
 # Override for custom domain:
 #   ZERO_QUERY_URL=https://app.yourdomain.com/api/zero/query
+#   ZERO_MUTATE_URL=https://app.yourdomain.com/api/zero/mutate
 # ZERO_QUERY_URL=http://frontend:3000/api/zero/query
+# ZERO_MUTATE_URL=http://frontend:3000/api/zero/mutate
 
 # ------------------------------------------------------------------------------
 # Database (defaults work out of the box, change for security)
diff --git a/docker/docker-compose.dev.yml b/docker/docker-compose.dev.yml
index e6cb3fd1d..564ecd772 100644
--- a/docker/docker-compose.dev.yml
+++ b/docker/docker-compose.dev.yml
@@ -185,6 +185,7 @@ services:
       - ZERO_REPLICA_FILE=/data/zero.db
       - ZERO_ADMIN_PASSWORD=${ZERO_ADMIN_PASSWORD:-surfsense-zero-admin}
       - ZERO_QUERY_URL=${ZERO_QUERY_URL:-http://frontend:3000/api/zero/query}
+      - ZERO_MUTATE_URL=${ZERO_MUTATE_URL:-http://frontend:3000/api/zero/mutate}
     volumes:
       - zero_cache_data:/data
     restart: unless-stopped
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 9b9993c7f..b03efdd2f 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -171,6 +171,7 @@ services:
       ZERO_REPLICA_FILE: /data/zero.db
       ZERO_ADMIN_PASSWORD: ${ZERO_ADMIN_PASSWORD:-surfsense-zero-admin}
       ZERO_QUERY_URL: ${ZERO_QUERY_URL:-http://frontend:3000/api/zero/query}
+      ZERO_MUTATE_URL: ${ZERO_MUTATE_URL:-http://frontend:3000/api/zero/mutate}
     volumes:
       - zero_cache_data:/data
     restart: unless-stopped
diff --git a/surfsense_web/app/api/zero/mutate/route.ts b/surfsense_web/app/api/zero/mutate/route.ts
new file mode 100644
index 000000000..0076e1ae8
--- /dev/null
+++ b/surfsense_web/app/api/zero/mutate/route.ts
@@ -0,0 +1,5 @@
+import { NextResponse } from "next/server";
+
+export async function POST() {
+	return NextResponse.json([]);
+}