diff --git a/docker/docker-compose.dev.yml b/docker/docker-compose.dev.yml
index b91b95af7..233a1629a 100644
--- a/docker/docker-compose.dev.yml
+++ b/docker/docker-compose.dev.yml
@@ -182,6 +182,7 @@ services:
       - ZERO_CHANGE_DB=${ZERO_CHANGE_DB:-postgresql://${DB_USER:-postgres}:${DB_PASSWORD:-postgres}@${DB_HOST:-db}:${DB_PORT:-5432}/${DB_NAME:-surfsense}?sslmode=${DB_SSLMODE:-disable}}
       - ZERO_REPLICA_FILE=/data/zero.db
       - ZERO_ADMIN_PASSWORD=${ZERO_ADMIN_PASSWORD:-surfsense-zero-admin}
+      - ZERO_QUERY_URL=${ZERO_QUERY_URL:-http://host.docker.internal:3000/api/zero/query}
     volumes:
       - zero_cache_data:/data
     restart: unless-stopped
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index d659fbd15..9dc5d5e14 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -168,6 +168,7 @@ services:
       ZERO_CHANGE_DB: ${ZERO_CHANGE_DB:-postgresql://${DB_USER:-surfsense}:${DB_PASSWORD:-surfsense}@${DB_HOST:-db}:${DB_PORT:-5432}/${DB_NAME:-surfsense}?sslmode=${DB_SSLMODE:-disable}}
       ZERO_REPLICA_FILE: /data/zero.db
       ZERO_ADMIN_PASSWORD: ${ZERO_ADMIN_PASSWORD:-surfsense-zero-admin}
+      ZERO_QUERY_URL: ${ZERO_QUERY_URL:-http://frontend:3000/api/zero/query}
     volumes:
       - zero_cache_data:/data
     restart: unless-stopped
diff --git a/surfsense_web/app/api/zero/query/route.ts b/surfsense_web/app/api/zero/query/route.ts
new file mode 100644
index 000000000..baee8bd75
--- /dev/null
+++ b/surfsense_web/app/api/zero/query/route.ts
@@ -0,0 +1,18 @@
+import { mustGetQuery } from "@rocicorp/zero";
+import { handleQueryRequest } from "@rocicorp/zero/server";
+import { NextResponse } from "next/server";
+import { queries } from "@/zero/queries";
+import { schema } from "@/zero/schema";
+
+export async function POST(request: Request) {
+	const result = await handleQueryRequest(
+		(name, args) => {
+			const query = mustGetQuery(queries, name);
+			return query.fn({ args, ctx: undefined });
+		},
+		schema,
+		request,
+	);
+
+	return NextResponse.json(result);
+}