diff --git a/app/(main)/admin/_tabs/policy.tsx b/app/(main)/admin/_tabs/policy.tsx
index 06257d09..ff124bf3 100644
--- a/app/(main)/admin/_tabs/policy.tsx
+++ b/app/(main)/admin/_tabs/policy.tsx
@@ -28,7 +28,7 @@ const FEATURE_GATE_LABELS: Partial<Record<keyof FeatureGates, { label: string; d
   crossStarredViewEnabled: { label: 'Unified Mailbox: Starred', description: 'Allow a "Starred" entry in the Unified Mailbox section that lists flagged/starred mail across the account and its shared folders (or every account when the cross-account sub-option is on). Honors the user\'s folder selection. Requires the matching per-user toggle in Settings → Appearance.' },
   crossAllViewEnabled: { label: 'Unified Mailbox: All Mail', description: 'Allow an "All mail" entry in the Unified Mailbox section that lists all mail across the account and its shared folders (or every account when the cross-account sub-option is on). Honors the user\'s folder selection. Requires the matching per-user toggle in Settings → Appearance.' },
   unifiedCrossAccountEnabled: { label: 'Unified Mailbox: Cross-account', description: 'Allow users to expand the Unified Mailbox beyond the active account boundary so its lists merge across every logged-in account. When off, the Unified Mailbox stays within the active account and its shared folders.' },
-  aiAssistantEnabled: { label: 'AI Assistant (preview)', description: 'Show the AI Assistant settings tab. No provider is wired up yet (see docs/AI-ASSISTANT-CONCEPT.md) — enabling this only proves the settings pane and policy fetch, it does not grant access to any model.' },
+  aiAssistantEnabled: { label: 'AI Assistant (preview)', description: 'Show the AI Assistant settings tab. Local (Ollama on the user\'s own machine or this desktop app) is free and unmetered; public (bring-your-own-key) is available too but not yet monitored or metered — see docs/AI-ASSISTANT-CONCEPT.md.' },
 };
 
 const RESTRICTABLE_SETTINGS = [
diff --git a/lib/admin/types.ts b/lib/admin/types.ts
index 741ab218..14b506bc 100644
--- a/lib/admin/types.ts
+++ b/lib/admin/types.ts
@@ -68,10 +68,10 @@ export interface FeatureGates {
   unifiedCrossAccountEnabled: boolean;
   /**
    * Master admin switch for the AI Assistant tab (docs/AI-ASSISTANT-CONCEPT.md).
-   * Defaults false, like pluginsEnabled — unlike every other gate, this one
-   * fronts a feature with no licensed provider class behind it yet (P1/P2 of
-   * that doc's phased rollout), so an admin opts in explicitly rather than
-   * every existing install suddenly showing a tab that does nothing.
+   * Defaults true as of the 2026-08-05 evening decision to make local AI
+   * visible by default (see lib/ai/types.ts) — local ships free with no
+   * entitlement gate, so there's a real, working feature behind this tab
+   * now, not an empty preview. An admin can still turn it off per-tenant.
    */
   aiAssistantEnabled: boolean;
 }
@@ -100,7 +100,7 @@ export const DEFAULT_FEATURE_GATES: FeatureGates = {
   crossStarredViewEnabled: false,
   crossAllViewEnabled: false,
   unifiedCrossAccountEnabled: false,
-  aiAssistantEnabled: false,
+  aiAssistantEnabled: true,
 };
 
 export interface ThemePolicy {
diff --git a/proxy.ts b/proxy.ts
index 4b7f29f6..39a6ae53 100644
--- a/proxy.ts
+++ b/proxy.ts
@@ -109,7 +109,22 @@ export async function proxy(request: NextRequest) {
   // https-served production app already gets unencrypted connections
   // blocked as mixed content by the browser itself, so allowing bare `ws:`
   // here would add no capability, only a false sense of one.
-  const connectSrc = isDev ? `'self' http: https: ws: wss:` : `'self' https: wss:`;
+  // `http://127.0.0.1:*`/`http://localhost:*` in production alongside
+  // `https:`: the AI Assistant's `local` provider class (lib/ai/local-client.ts)
+  // talks directly to a loopback Ollama-compatible runtime, over plain HTTP -
+  // Ollama has no built-in TLS story, and there's no realistic MITM risk to
+  // guard against on loopback (no network hop ever occurs). This is
+  // deliberately NOT the same relaxation as blanket `http:` in dev: a
+  // narrow, loopback-only allowance doesn't reopen the mixed-content-style
+  // downgrade risk documented below for `wss:`. Confirmed as a real gap, not
+  // theoretical: before this fix, a production build's own Electron shell
+  // blocked `fetch('http://127.0.0.1:11434/...')` before any network
+  // attempt happened at all (a CSP violation, connect-src as the violated
+  // directive) - `local` was entirely inert in a production build,
+  // Electron or browser alike.
+  const connectSrc = isDev
+    ? `'self' http: https: ws: wss:`
+    : `'self' https: wss: http://127.0.0.1:* http://localhost:*`;
 
   const frameAncestors = isSandboxPath
     ? `'self'`