diff --git a/.blox/workstation.yaml b/.blox/workstation.yaml
new file mode 100644
index 000000000..917142860
--- /dev/null
+++ b/.blox/workstation.yaml
@@ -0,0 +1,6 @@
+# The ACP endpoint binds 0.0.0.0, so it requires a secret key; a random one is
+# generated and printed per launch unless GOOSE_SERVER__SECRET_KEY is set.
+run:
+  - name: ACP Server
+    command: 'export GOOSE_SERVER__SECRET_KEY="${GOOSE_SERVER__SECRET_KEY:-$(openssl rand -hex 32)}"; echo "ACP secret key: $GOOSE_SERVER__SECRET_KEY"; exec goose serve --platform desktop --host 0.0.0.0 --port 3284'
+    port: 3284