diff --git a/server/cmd/chromium-launcher/main.go b/server/cmd/chromium-launcher/main.go
index 19f93e47..7bce8506 100644
--- a/server/cmd/chromium-launcher/main.go
+++ b/server/cmd/chromium-launcher/main.go
@@ -25,6 +25,8 @@ const (
 	// pulseSink is the null sink chromium plays into; the recorder captures
 	// its .monitor source.
 	pulseSink = "KernelOutput"
+
+	defaultPrivateNetworkBypassFlag = "--proxy-bypass-list=10.0.0.0/8;172.16.0.0/12;192.168.0.0/16;100.64.0.0/10;fc00::/7"
 )
 
 func main() {
@@ -79,6 +81,7 @@ func main() {
 		os.Exit(1)
 	}
 	final := chromiumflags.MergeFlagsWithRuntimeTokens(baseFlags, runtimeTokens)
+	final = withDefaultPrivateNetworkBypass(final)
 
 	// Diagnostics for parity with previous scripts
 	fmt.Printf("BASE_FLAGS: %s\n", baseFlags)
@@ -158,6 +161,15 @@ func main() {
 	}
 }
 
+func withDefaultPrivateNetworkBypass(flags []string) []string {
+	for _, flag := range flags {
+		if flag == "--proxy-bypass-list" || strings.HasPrefix(flag, "--proxy-bypass-list=") {
+			return flags
+		}
+	}
+	return append(flags, defaultPrivateNetworkBypassFlag)
+}
+
 // execLookPath helps satisfy syscall.Exec's requirement to pass an absolute path.
 func execLookPath(file string) (string, error) {
 	if strings.ContainsRune(file, os.PathSeparator) {
diff --git a/server/cmd/chromium-launcher/main_test.go b/server/cmd/chromium-launcher/main_test.go
index 7b4ba40a..6e6d11b0 100644
--- a/server/cmd/chromium-launcher/main_test.go
+++ b/server/cmd/chromium-launcher/main_test.go
@@ -4,9 +4,69 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"reflect"
 	"testing"
+
+	"github.com/kernel/kernel-images/server/lib/chromiumflags"
 )
 
+func TestWithDefaultPrivateNetworkBypass(t *testing.T) {
+	tests := []struct {
+		name  string
+		flags []string
+		want  []string
+	}{
+		{
+			name: "image default",
+			want: []string{defaultPrivateNetworkBypassFlag},
+		},
+		{
+			name:  "default follows unrelated flags",
+			flags: []string{"--kiosk"},
+			want:  []string{"--kiosk", defaultPrivateNetworkBypassFlag},
+		},
+		{
+			name:  "custom list replaces image default",
+			flags: []string{"--proxy-bypass-list=preview.internal"},
+			want:  []string{"--proxy-bypass-list=preview.internal"},
+		},
+		{
+			name:  "explicit empty list clears image default",
+			flags: []string{"--proxy-bypass-list="},
+			want:  []string{"--proxy-bypass-list="},
+		},
+		{
+			name:  "bare empty list clears image default",
+			flags: []string{"--proxy-bypass-list"},
+			want:  []string{"--proxy-bypass-list"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := withDefaultPrivateNetworkBypass(tt.flags)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Fatalf("withDefaultPrivateNetworkBypass() mismatch:\n got: %#v\nwant: %#v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestDefaultPrivateNetworkBypassPreservesRuntimePrecedence(t *testing.T) {
+	configured := chromiumflags.MergeFlagsWithRuntimeTokens(
+		"--proxy-bypass-list=preview.internal",
+		[]string{defaultPrivateNetworkBypassFlag},
+	)
+	got := withDefaultPrivateNetworkBypass(configured)
+	want := []string{
+		"--proxy-bypass-list=preview.internal",
+		defaultPrivateNetworkBypassFlag,
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("runtime precedence changed:\n got: %#v\nwant: %#v", got, want)
+	}
+}
+
 func TestExecLookPath(t *testing.T) {
 	dir := t.TempDir()
 	bin := filepath.Join(dir, "mybin")