diff --git a/backend/src/rails/rails.service.ts b/backend/src/rails/rails.service.ts
index 3e02393..8dcc9ee 100644
--- a/backend/src/rails/rails.service.ts
+++ b/backend/src/rails/rails.service.ts
@@ -96,18 +96,28 @@ export class RailsService {
   }
 
   /**
-   * Fetch raw file content from the internal Gitea. Restricted to the
-   * Gitea host for safety.
+   * Fetch raw file content from a Git host. Restricted to an allowlist
+   * of hosts for SSRF safety.
+   *
+   * Allowlist is configured via env var GIT_RAW_ALLOWED_HOSTS — comma
+   * separated. Defaults to the hanarang-internal Gitea instance.
    */
   async fetchFileContent(rawUrl: string): Promise<string | null> {
-    const allowedHost = 'git.nabomhalang.co.kr';
+    const allowedHosts = (
+      this.config.get<string>('GIT_RAW_ALLOWED_HOSTS') ??
+      'git.nabomhalang.co.kr'
+    )
+      .split(',')
+      .map((h) => h.trim())
+      .filter(Boolean);
+
     let parsed: URL;
     try {
       parsed = new URL(rawUrl);
     } catch {
       return null;
     }
-    if (parsed.host !== allowedHost) return null;
+    if (!allowedHosts.includes(parsed.host)) return null;
 
     try {
       const controller = new AbortController();