diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1df02ca29..f564e9ae4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,10 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+### Added
+
+ - #3558, Add the `admin-server-host` config to set the host for the admin server - @develop7
+
 ### Changed
 
  - #2052, Dropped support for PostgreSQL 9.6 - @wolfgangwalther
diff --git a/docs/references/configuration.rst b/docs/references/configuration.rst
index 8b02d3e1e..7dbb42a5e 100644
--- a/docs/references/configuration.rst
+++ b/docs/references/configuration.rst
@@ -146,6 +146,21 @@ To reload the configuration from within the database, you can use the ``NOTIFY``
 List of parameters
 ==================
 
+.. _admin-server-host:
+
+admin-server-host
+-----------------
+
+  =============== =======================
+  **Type**        String
+  **Default**     `server-host` value
+  **Reloadable**  N
+  **Environment** PGRST_ADMIN_SERVER_HOST
+  **In-Database** `n/a`
+  =============== =======================
+
+  Specifies the host for the :ref:`admin_server`. Defaults to :ref:`server-host` value.
+
 .. _admin-server-port:
 
 admin-server-port
diff --git a/src/PostgREST/AppState.hs b/src/PostgREST/AppState.hs
index 725b30bee..f053f5601 100644
--- a/src/PostgREST/AppState.hs
+++ b/src/PostgREST/AppState.hs
@@ -192,7 +192,8 @@ initSockets AppConfig{..} = do
     cfg'uspm = configServerUnixSocketMode
     cfg'host = configServerHost
     cfg'port = configServerPort
-    cfg'adminport = configAdminServerPort
+    cfg'adminHost = configAdminServerHost
+    cfg'adminPort = configAdminServerPort
 
   sock <- case cfg'usp of
     -- I'm not using `streaming-commons`' bindPath function here because it's not defined for Windows,
@@ -210,9 +211,9 @@ initSockets AppConfig{..} = do
             pure (num, sock)
       pure sock
 
-  adminSock <- case cfg'adminport of
+  adminSock <- case cfg'adminPort of
     Just adminPort -> do
-      adminSock <- bindPortTCP adminPort (fromString $ T.unpack cfg'host)
+      adminSock <- bindPortTCP adminPort (fromString $ T.unpack cfg'adminHost)
       pure $ Just adminSock
     Nothing -> pure Nothing
 
diff --git a/src/PostgREST/Config.hs b/src/PostgREST/Config.hs
index bc729775f..5eb937e7c 100644
--- a/src/PostgREST/Config.hs
+++ b/src/PostgREST/Config.hs
@@ -106,6 +106,7 @@ data AppConfig = AppConfig
   , configServerTimingEnabled      :: Bool
   , configServerUnixSocket         :: Maybe FilePath
   , configServerUnixSocketMode     :: FileMode
+  , configAdminServerHost          :: Text
   , configAdminServerPort          :: Maybe Int
   , configRoleSettings             :: RoleSettings
   , configRoleIsoLvl               :: RoleIsolationLvl
@@ -176,6 +177,7 @@ toText conf =
       ,("server-timing-enabled",         T.toLower . show . configServerTimingEnabled)
       ,("server-unix-socket",        q . maybe mempty T.pack . configServerUnixSocket)
       ,("server-unix-socket-mode",   q . T.pack . showSocketMode)
+      ,("admin-server-host",         q . configAdminServerHost)
       ,("admin-server-port",             maybe "\"\"" show . configAdminServerPort)
       ]
 
@@ -276,12 +278,14 @@ parser optPath env dbSettings roleSettings roleIsolationLvl =
     <*> (fromMaybe False <$> optBool "openapi-security-active")
     <*> parseOpenAPIServerProxyURI "openapi-server-proxy-uri"
     <*> parseCORSAllowedOrigins "server-cors-allowed-origins"
-    <*> (fromMaybe "!4" <$> optString "server-host")
+    <*> (defaultServerHost <$> optString "server-host")
     <*> (fromMaybe 3000 <$> optInt "server-port")
     <*> (fmap (CI.mk . encodeUtf8) <$> optString "server-trace-header")
     <*> (fromMaybe False <$> optBool "server-timing-enabled")
     <*> (fmap T.unpack <$> optString "server-unix-socket")
     <*> parseSocketFileMode "server-unix-socket-mode"
+    <*> (defaultServerHost <$> optWithAlias (optString "admin-server-host")
+                                            (optString "server-host"))
     <*> optInt "admin-server-port"
     <*> pure roleSettings
     <*> pure roleIsolationLvl
@@ -412,6 +416,9 @@ parser optPath env dbSettings roleSettings roleIsolationLvl =
 
     defaultHoistedAllowList = ["statement_timeout","plan_filter.statement_cost_limit","default_transaction_isolation"]
 
+    defaultServerHost :: Maybe Text -> Text
+    defaultServerHost = fromMaybe "!4"
+
 -- | Read the JWT secret from a file if configJwtSecret is actually a
 -- filepath(has @ as its prefix). To check if the JWT secret is provided is
 -- in fact a file path, it must be decoded as 'Text' to be processed.
diff --git a/test/io/configs/expected/aliases.config b/test/io/configs/expected/aliases.config
index 00d9414e0..13243d157 100644
--- a/test/io/configs/expected/aliases.config
+++ b/test/io/configs/expected/aliases.config
@@ -35,4 +35,5 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""
diff --git a/test/io/configs/expected/boolean-numeric.config b/test/io/configs/expected/boolean-numeric.config
index 5c025e0c1..9cdbc660d 100644
--- a/test/io/configs/expected/boolean-numeric.config
+++ b/test/io/configs/expected/boolean-numeric.config
@@ -35,4 +35,5 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""
diff --git a/test/io/configs/expected/boolean-string.config b/test/io/configs/expected/boolean-string.config
index 5c025e0c1..9cdbc660d 100644
--- a/test/io/configs/expected/boolean-string.config
+++ b/test/io/configs/expected/boolean-string.config
@@ -35,4 +35,5 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""
diff --git a/test/io/configs/expected/defaults.config b/test/io/configs/expected/defaults.config
index 1d0c095d6..0e55e8e9e 100644
--- a/test/io/configs/expected/defaults.config
+++ b/test/io/configs/expected/defaults.config
@@ -35,4 +35,5 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""
diff --git a/test/io/configs/expected/no-defaults-with-db-other-authenticator.config b/test/io/configs/expected/no-defaults-with-db-other-authenticator.config
index 3717e99e5..a15cd0b4e 100644
--- a/test/io/configs/expected/no-defaults-with-db-other-authenticator.config
+++ b/test/io/configs/expected/no-defaults-with-db-other-authenticator.config
@@ -35,6 +35,7 @@ server-trace-header = "traceparent"
 server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
+admin-server-host = "127.0.0.1"
 admin-server-port = 3001
 app.settings.test = "test"
 app.settings.test2 = "test"
diff --git a/test/io/configs/expected/no-defaults-with-db.config b/test/io/configs/expected/no-defaults-with-db.config
index 5f78327ba..fc197f2a8 100644
--- a/test/io/configs/expected/no-defaults-with-db.config
+++ b/test/io/configs/expected/no-defaults-with-db.config
@@ -35,6 +35,7 @@ server-trace-header = "CF-Ray"
 server-timing-enabled = false
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
+admin-server-host = "127.0.0.1"
 admin-server-port = 3001
 app.settings.test = "test"
 app.settings.test2 = "test"
diff --git a/test/io/configs/expected/no-defaults.config b/test/io/configs/expected/no-defaults.config
index 57f6b2dc0..e362e40c1 100644
--- a/test/io/configs/expected/no-defaults.config
+++ b/test/io/configs/expected/no-defaults.config
@@ -35,6 +35,7 @@ server-trace-header = "X-Request-Id"
 server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
+admin-server-host = "127.0.0.1"
 admin-server-port = 3001
 app.settings.test = "test"
 app.settings.test2 = "test"
diff --git a/test/io/configs/expected/types.config b/test/io/configs/expected/types.config
index b363c94bb..bc7815e3e 100644
--- a/test/io/configs/expected/types.config
+++ b/test/io/configs/expected/types.config
@@ -35,5 +35,6 @@ server-trace-header = ""
 server-timing-enabled = false
 server-unix-socket = ""
 server-unix-socket-mode = "660"
+admin-server-host = "!4"
 admin-server-port = ""
 app.settings.test = "Bool False"
diff --git a/test/io/configs/no-defaults-env.yaml b/test/io/configs/no-defaults-env.yaml
index 915497b18..459f788aa 100644
--- a/test/io/configs/no-defaults-env.yaml
+++ b/test/io/configs/no-defaults-env.yaml
@@ -38,4 +38,5 @@ PGRST_SERVER_TRACE_HEADER: X-Request-Id
 PGRST_SERVER_TIMING_ENABLED: true
 PGRST_SERVER_UNIX_SOCKET: /tmp/pgrst_io_test.sock
 PGRST_SERVER_UNIX_SOCKET_MODE: 777
+PGRST_ADMIN_SERVER_HOST: 127.0.0.1
 PGRST_ADMIN_SERVER_PORT: 3001
diff --git a/test/io/configs/no-defaults.config b/test/io/configs/no-defaults.config
index 1f54505a3..025661839 100644
--- a/test/io/configs/no-defaults.config
+++ b/test/io/configs/no-defaults.config
@@ -36,5 +36,6 @@ server-timing-enabled = true
 server-unix-socket = "/tmp/pgrst_io_test.sock"
 server-unix-socket-mode = "777"
 admin-server-port = 3001
+admin-server-host = "127.0.0.1"
 app.settings.test = "test"
 app.settings.test2 = "test"
diff --git a/test/io/db_config.sql b/test/io/db_config.sql
index 630e3e5cd..b139e87dc 100644
--- a/test/io/db_config.sql
+++ b/test/io/db_config.sql
@@ -35,6 +35,7 @@ CREATE DATABASE other;
 ALTER ROLE db_config_authenticator IN DATABASE other SET pgrst.db_max_rows = '1111';
 
 -- non-reloadable configs
+ALTER ROLE db_config_authenticator SET pgrst.admin_server_host = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.admin_server_port = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_channel = 'ignored';
 ALTER ROLE db_config_authenticator SET pgrst.db_channel_enabled = 'ignored';
diff --git a/test/spec/SpecHelper.hs b/test/spec/SpecHelper.hs
index e4e64b41b..0ee237804 100644
--- a/test/spec/SpecHelper.hs
+++ b/test/spec/SpecHelper.hs
@@ -150,6 +150,7 @@ baseCfg = let secret = Just $ encodeUtf8 "reallyreallyreallyreallyverysafe" in
   , configServerUnixSocketMode      = 432
   , configDbTxAllowOverride         = True
   , configDbTxRollbackAll           = True
+  , configAdminServerHost           = "localhost"
   , configAdminServerPort           = Nothing
   , configRoleSettings              = mempty
   , configRoleIsoLvl                = mempty