diff --git a/crates/hephd/src/main.rs b/crates/hephd/src/main.rs
index c8e4e25..fde7d57 100644
--- a/crates/hephd/src/main.rs
+++ b/crates/hephd/src/main.rs
@@ -231,14 +231,17 @@ async fn main() -> Result<()> {
 
     tracing::info!(socket = %socket.display(), mode = ?cli.mode, "hephd listening");
 
-    // macOS local mode: supervise the global quick-capture popover (⌘'). hephd
-    // already runs as a `gui/$uid` LaunchAgent, so its child inherits the Aqua
-    // session the hotkey/GUI need — no separate launch agent. Opt-in via
-    // HEPH_QUICKADD=1 (the installed plist sets it) so dev/test runs that spawn a
-    // local daemon never pop a window. The helper self-exits when this daemon
-    // goes away, so killing hephd (even `kill -9`) leaves nothing behind.
+    // macOS store-owning modes: supervise the global quick-capture popover (⌘').
+    // hephd already runs as a `gui/$uid` LaunchAgent, so its child inherits the
+    // Aqua session the hotkey/GUI need — no separate launch agent. Both `local`
+    // and `server` own the local store on the device (server is local + an HTTP
+    // hub), so both should drive the desktop popover; only `client` (a thin
+    // remote proxy) does not. Opt-in via HEPH_QUICKADD=1 (the installed plist
+    // sets it) so dev/test runs that spawn a daemon never pop a window. The
+    // helper self-exits when this daemon goes away, so killing hephd (even
+    // `kill -9`) leaves nothing behind.
     #[cfg(target_os = "macos")]
-    if cli.mode == Mode::Local && quickadd_enabled() {
+    if matches!(cli.mode, Mode::Local | Mode::Server) && quickadd_enabled() {
         spawn_quickadd_supervisor(socket.clone());
     }
 
diff --git a/heph-pwa/src/rpc.js b/heph-pwa/src/rpc.js
index cb8c6d9..8f8b690 100644
--- a/heph-pwa/src/rpc.js
+++ b/heph-pwa/src/rpc.js
@@ -8,12 +8,20 @@
 const SETTINGS_KEY = "heph-pwa:settings";
 
 export function loadSettings() {
+  let s = {};
   try {
-    const s = JSON.parse(localStorage.getItem(SETTINGS_KEY) || "{}");
-    return { baseUrl: s.baseUrl || "", token: s.token || "" };
+    s = JSON.parse(localStorage.getItem(SETTINGS_KEY) || "{}");
   } catch {
-    return { baseUrl: "", token: "" };
+    s = {};
   }
+  let baseUrl = s.baseUrl || "";
+  // Served from the hub? Default the hub URL to our own origin so the app is
+  // zero-config out of the box (the Settings screen still lets you override,
+  // e.g. when the shell is hosted separately from the hub).
+  if (!baseUrl && typeof location !== "undefined" && /^https?:/.test(location.origin)) {
+    baseUrl = location.origin;
+  }
+  return { baseUrl, token: s.token || "" };
 }
 
 export function saveSettings(settings) {
diff --git a/heph-pwa/sw.js b/heph-pwa/sw.js
index fef89ff..3ecb45d 100644
--- a/heph-pwa/sw.js
+++ b/heph-pwa/sw.js
@@ -1,7 +1,7 @@
 // Service worker: cache the app shell so heph launches offline. Data is never
 // cached — every /rpc call must hit the live hub (and POSTs aren't cacheable
 // anyway). Bump CACHE when shell assets change to evict the old set.
-const CACHE = "heph-pwa-v1";
+const CACHE = "heph-pwa-v2";
 const SHELL = [
   "./",
   "./index.html",