diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index c34961df..04fcfd6a 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -1,4 +1,5 @@
-import { defineConfig, type Plugin } from "vite";
+import { ServerResponse } from "node:http";
+import { defineConfig, type Plugin, type ProxyOptions } from "vite";
 import { reactWithCompiler } from "./reactPlugin";
 import { devOnlyGuard } from "./devOnlyGuard";
 
@@ -10,7 +11,20 @@ const target = "http://127.0.0.1:8080";
 // (the TCP target is still 127.0.0.1:8080 — changeOrigin only rewrites the header). The backend uses
 // that header to send the OAuth redirect_uri back to :5173, so a Google login started on the Vite dev
 // server returns to :5173 instead of the fixed :8080 callback. (Both are registered in the console.)
-const proxyOpts = { target, changeOrigin: false };
+//
+// A failed connect to the container (on Windows the Docker port publish now and then times one out)
+// is a gateway failure, so it answers 502 like the prod reverse proxy: the app reads that as a
+// passing connection loss (a quiet notice; a GET is retried once). Vite's own handler, which runs
+// after this one and leaves an answered response alone, sends a bodiless 500 — read as a real
+// server fault, the blocking error dialog.
+const proxyOpts: ProxyOptions = {
+  target,
+  changeOrigin: false,
+  configure: (proxy) =>
+    proxy.on("error", (_err, _req, res) => {
+      if (res instanceof ServerResponse && !res.headersSent) res.writeHead(502).end();
+    }),
+};
 const proxy = {
   "/api": proxyOpts,
   "/auth": proxyOpts,