diff --git a/flake.lock b/flake.lock
index 7590793..5ed46c3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -233,11 +233,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772845525,
-        "narHash": "sha256-Dp5Ir2u4jJDGCgeMRviHvEQDe+U37hMxp6RSNOoMMPc=",
+        "lastModified": 1773367248,
+        "narHash": "sha256-FFMc1uAwy2GYasd0rdNDVxKyAgzuoJH2M+GglBQbqf0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "27b93804fbef1544cb07718d3f0a451f4c4cd6c0",
+        "rev": "be0c641a6a5564caa33982faa1fe2c60d92131c7",
         "type": "github"
       },
       "original": {
@@ -471,11 +471,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1772793846,
-        "narHash": "sha256-Nobd52UJijiRrKNX3FkgwUGRMjQ6J5kWq/xSUnHbWR8=",
-        "owner": "NixOS",
+        "lastModified": 1773282481,
+        "narHash": "sha256-b/GV2ysM8mKHhinse2wz+uP37epUrSE+sAKXy/xvBY4=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1a0fccf8299acc1a36f7154efd13f6d005533d09",
+        "rev": "fe416aaedd397cacb33a610b33d60ff2b431b127",
         "type": "github"
       },
       "original": {
@@ -538,11 +538,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1772875143,
-        "narHash": "sha256-ENBRe7vCCp/SIG2WRKI2pyAxwnrc9CPuwZ4CtMu4KU4=",
+        "lastModified": 1773343795,
+        "narHash": "sha256-0+HEuOytpwyPt7i1jj6v2QJ+NXXisCYnL2XNwPBltvg=",
         "owner": "NotAShelf",
         "repo": "nvf",
-        "rev": "6681e33727409d4ccfa687de981b594110a735d6",
+        "rev": "83b44eaf50b96bd5d06b1a56a3a51f1b2362db52",
         "type": "github"
       },
       "original": {
@@ -573,11 +573,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772495394,
-        "narHash": "sha256-hmIvE/slLKEFKNEJz27IZ8BKlAaZDcjIHmkZ7GCEjfw=",
+        "lastModified": 1773096132,
+        "narHash": "sha256-M3zEnq9OElB7zqc+mjgPlByPm1O5t2fbUrH3t/Hm5Ag=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "1d9b98a29a45abe9c4d3174bd36de9f28755e3ff",
+        "rev": "d1ff3b1034d5bab5d7d8086a7803c5a5968cd784",
         "type": "github"
       },
       "original": {
@@ -794,11 +794,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772858378,
-        "narHash": "sha256-VPRlTud1REOz0GPjq3XQNjk5GpH/xNbeadiul4gkPGA=",
+        "lastModified": 1773290887,
+        "narHash": "sha256-L1yMYmFffHfZNP+hKJGRBmrFKkn/VDhu7jEbVftBQuM=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "42e1e9a1cb5b507789a51193113d56f8f1bb08d9",
+        "rev": "9346698c4562819f61b4e5097151ec0b17729fab",
         "type": "github"
       },
       "original": {
diff --git a/hosts/muon/configuration.nix b/hosts/muon/configuration.nix
index b999d85..5166155 100644
--- a/hosts/muon/configuration.nix
+++ b/hosts/muon/configuration.nix
@@ -69,6 +69,20 @@ in {
   services.xserver.windowManager.i3.enable = true;
   services.actual.enable = true;
 
+  # Reverse proxy: *.word.local -> localhost:3030
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts."~^(?<subdomain>.+)\\.word\\.local$" = {
+      serverName = "~^(?<subdomain>.+)\\.word\\.local$";
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3030";
+        proxyWebsockets = true;
+      };
+    };
+  };
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
   virtualisation.virtualbox.host.enable = true;
   users.extraGroups.vboxusers.members = ["user-with-access-to-virtualbox"];
 
diff --git a/modules/nixos/core/network.nix b/modules/nixos/core/network.nix
index 91317d8..abce4bf 100644
--- a/modules/nixos/core/network.nix
+++ b/modules/nixos/core/network.nix
@@ -100,6 +100,15 @@ in
         10.0.0.2 muon
         10.0.0.3 muho
         10.0.0.4 muop
+        127.0.0.1 word.local
+      '';
+
+      # Wildcard DNS: *.word.local -> 127.0.0.1 via NetworkManager's built-in dnsmasq
+      networking.networkmanager.dns = "dnsmasq";
+      # Force resolv.conf to use local dnsmasq so wildcard DNS is actually queried
+      networking.resolvconf.useLocalResolver = true;
+      environment.etc."NetworkManager/dnsmasq.d/word-local.conf".text = ''
+        address=/.word.local/127.0.0.1
       '';
 
       # gateway =