diff --git a/JanitorialQC.xcodeproj/project.pbxproj b/JanitorialQC.xcodeproj/project.pbxproj
index 3030da1..890fe89 100644
--- a/JanitorialQC.xcodeproj/project.pbxproj
+++ b/JanitorialQC.xcodeproj/project.pbxproj
@@ -411,7 +411,7 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 2;
 				DEVELOPMENT_TEAM = SB7DNYC9TY;
 				ENABLE_PREVIEWS = YES;
 				GENERATE_INFOPLIST_FILE = YES;
@@ -454,7 +454,7 @@
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 1;
+				CURRENT_PROJECT_VERSION = 2;
 				DEVELOPMENT_TEAM = SB7DNYC9TY;
 				ENABLE_PREVIEWS = YES;
 				GENERATE_INFOPLIST_FILE = YES;
diff --git a/JanitorialQC/Info.plist b/JanitorialQC/Info.plist
index ba2eaea..be45685 100644
--- a/JanitorialQC/Info.plist
+++ b/JanitorialQC/Info.plist
@@ -17,10 +17,32 @@
 	<array>
 		<string>com.jqc.sync</string>
 	</array>
+	<!-- App Transport Security.
+
+	     Both real servers (jqc / jqc1) are HTTPS and need no exception at all.
+	     This block exists ONLY so a developer can point ServerOption.primary at
+	     a local http backend (http://127.0.0.1:5055) while working on the API.
+
+	     It is deliberately scoped to loopback. The previous version of this key
+	     was a blanket NSAllowsArbitraryLoads=true, which disables ATS for EVERY
+	     host — it turns off certificate and TLS validation for the production
+	     servers too, and App Store review requires a justification for it. Do
+	     not reintroduce the blanket flag; add a specific domain here instead. -->
 	<key>NSAppTransportSecurity</key>
 	<dict>
-		<key>NSAllowsArbitraryLoads</key>
-		<true/>
+		<key>NSExceptionDomains</key>
+		<dict>
+			<key>127.0.0.1</key>
+			<dict>
+				<key>NSExceptionAllowsInsecureHTTPLoads</key>
+				<true/>
+			</dict>
+			<key>localhost</key>
+			<dict>
+				<key>NSExceptionAllowsInsecureHTTPLoads</key>
+				<true/>
+			</dict>
+		</dict>
 	</dict>
 	<key>UIBackgroundModes</key>
 	<array>
diff --git a/JanitorialQC/Utils/Constants.swift b/JanitorialQC/Utils/Constants.swift
index 529d711..371d0fc 100644
--- a/JanitorialQC/Utils/Constants.swift
+++ b/JanitorialQC/Utils/Constants.swift
@@ -8,7 +8,7 @@ import Foundation
 
 /// The two known JQC servers the inspector can connect to.
 nonisolated enum ServerOption: String, CaseIterable, Sendable {
-    case primary   = "http://127.0.0.1:5055"
+    case primary   = "https://jqc.ltservicesinc.com"
     case secondary = "https://jqc1.ltservicesinc.com"
 
     var displayName: String {