diff --git a/README.md b/README.md
index 239bfe9..c0f9459 100644
--- a/README.md
+++ b/README.md
@@ -144,6 +144,9 @@ CI_ENVIRONMENT = production          # use "development" while installing
 # APP
 #--------------------------------------------------------------------
 app.baseURL = 'https://hms.yourhospital.in/'
+app.allowedHostnames = localhost,hms.yourhospital.in,100001.dhms.in
+# or JSON format:
+# app.allowedHostnames = ["localhost","hms.yourhospital.in","100001.dhms.in"]
 app.appTimezone = 'Asia/Kolkata'     # adjust to your timezone
 
 #--------------------------------------------------------------------
@@ -186,6 +189,15 @@ EKA_BEARER_TOKEN = your-token
 # EKA_WEBHOOK_SECRET = shared-secret-for-callback-signature
 ```
 
+### HealthPlix callback secret fallback
+
+If `HEALTHPLIX_FETCH_SECRET` is set in `.env`, `POST /healthplix/fetch` uses it as fallback
+when the hospital setting value is empty.
+
+```dotenv
+HEALTHPLIX_FETCH_SECRET = your-shared-secret
+```
+
 Then process queue normally:
 
 ```bash
diff --git a/app/Config/App.php b/app/Config/App.php
index 15b9768..84db2c1 100644
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -22,6 +22,11 @@ class App extends BaseConfig
     {
         parent::__construct();
 
+        $envAllowedHostnames = $this->resolveAllowedHostnamesFromEnv();
+        if ($envAllowedHostnames !== []) {
+            $this->allowedHostnames = $envAllowedHostnames;
+        }
+
         if ($this->baseURL === '') {
             $isHttps = ! empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
             $scheme  = $isHttps ? 'https' : 'http';
@@ -31,6 +36,43 @@ class App extends BaseConfig
         }
     }
 
+    /**
+     * Accepts .env value in either CSV or JSON array format.
+     * Example CSV: app.allowedHostnames = localhost,100001.dhms.in
+     * Example JSON: app.allowedHostnames = ["localhost","100001.dhms.in"]
+     *
+     * @return list<string>
+     */
+    private function resolveAllowedHostnamesFromEnv(): array
+    {
+        $raw = trim((string) env('app.allowedHostnames', ''));
+        if ($raw === '') {
+            return [];
+        }
+
+        $items = [];
+        if (str_starts_with($raw, '[')) {
+            $decoded = json_decode($raw, true);
+            if (is_array($decoded)) {
+                $items = $decoded;
+            }
+        } else {
+            $items = preg_split('/[\r\n,]+/', $raw) ?: [];
+        }
+
+        $hostnames = [];
+        foreach ($items as $item) {
+            $hostname = trim((string) $item);
+            if ($hostname === '') {
+                continue;
+            }
+
+            $hostnames[] = $hostname;
+        }
+
+        return array_values(array_unique($hostnames));
+    }
+
     /**
      * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
      * If you want to accept multiple Hostnames, set this.
@@ -46,6 +88,7 @@ class App extends BaseConfig
         'localhost',
         'hmskrishnaksp.dhms.in',
         'hmslocal.devsofttech.co.in',
+        'khrc1.dhms.in',
     ];
 
     /**
diff --git a/env b/env
index fc050a1..e482206 100644
--- a/env
+++ b/env
@@ -23,6 +23,9 @@
 # app.baseURL = ''
 # If you have trouble with `.`, you could also use `_`.
 # app_baseURL = ''
+# Comma-separated or JSON array host allowlist (optional).
+# app.allowedHostnames = localhost,100001.dhms.in
+# app.allowedHostnames = ["localhost","100001.dhms.in"]
 # app.forceGlobalSecureRequests = false
 # app.CSPEnabled = false
 
@@ -96,3 +99,25 @@
 # Webhook signature verification secret for callback endpoints.
 # If empty, signature validation is skipped.
 # EKA_WEBHOOK_SECRET =
+
+#--------------------------------------------------------------------
+# HEALTHPLIX INTEGRATION (OPTIONAL)
+#--------------------------------------------------------------------
+
+# Enable per hospital using Admin panel by default.
+# These env keys can be used as deployment fallback defaults.
+
+# HEALTHPLIX_ENABLED = 0
+# HEALTHPLIX_BASE_URL =
+# HEALTHPLIX_TENANT_HEADER_NAME = tenant_id
+# HEALTHPLIX_TENANT_ID =
+# HEALTHPLIX_TENANT_KEY =
+# HEALTHPLIX_TOKEN_PATH =
+# HEALTHPLIX_PATIENT_PATH =
+# HEALTHPLIX_APPOINTMENT_PATH =
+# HEALTHPLIX_DOCTOR_IDENTIFIER =
+# HEALTHPLIX_DOCTOR_EMAIL =
+# HEALTHPLIX_SERVICE_IDENTIFIER =
+# HEALTHPLIX_SERVICE_NAME =
+# Optional fallback secret used by POST /healthplix/fetch when hospital_setting has no value.
+# HEALTHPLIX_FETCH_SECRET =