diff --git a/README.md b/README.md
index 2c4f824..9fa84d5 100644
--- a/README.md
+++ b/README.md
@@ -45,12 +45,16 @@ jobs:
 
 | Output | Description |
 | --- | --- |
-| `endpoint` | e.g. `http://127.0.0.1:8080` (same as `AWS_ENDPOINT_URL`) |
+| `endpoint` | e.g. `http://localhost:8080` (same as `AWS_ENDPOINT_URL`) |
 | `access-key-id` | root access key ID |
 | `region` | region HomeCloud serves (`us-east-1`) |
 | `log-file` | path of the server log |
 
 AWS CLI v2 and current AWS SDKs read `AWS_ENDPOINT_URL`, so most tools need no configuration.
+The endpoint names the server `localhost` (it listens on `127.0.0.1`), as `homecloud aws-env`
+does: S3 Control, which the Terraform AWS provider calls for every bucket, puts the account ID
+in front of the host name, and `123456789012.localhost` resolves where `123456789012.127.0.0.1`
+does not.
 
 ## Examples
 
diff --git a/setup.sh b/setup.sh
index c303c1e..1bd79fe 100755
--- a/setup.sh
+++ b/setup.sh
@@ -97,9 +97,12 @@ mask_password() {
   return 0
 }
 
-endpoint="http://127.0.0.1:$port"
+# The server listens on 127.0.0.1; AWS tools get it as localhost, like `homecloud aws-env`
+# prints it: S3 Control (which the Terraform AWS provider calls for every bucket) puts the
+# account ID in front of the host, and only a host name resolves that way.
+endpoint="http://localhost:$port"
 deadline=$((SECONDS + timeout))
-until curl -fsS --connect-timeout 2 --max-time 5 "$endpoint/api/v1/health" >/dev/null 2>&1; do
+until curl -fsS --connect-timeout 2 --max-time 5 "http://127.0.0.1:$port/api/v1/health" >/dev/null 2>&1; do
   mask_password
   kill -0 "$pid" 2>/dev/null || fail "homecloud serve exited before it became healthy (the post step prints its log)"
   [ "$SECONDS" -lt "$deadline" ] || fail "HomeCloud was not healthy after ${timeout}s"