diff --git a/studio/backend/core/rag/captioner.py b/studio/backend/core/rag/captioner.py
index e29c9c9a7a..6d1512a770 100644
--- a/studio/backend/core/rag/captioner.py
+++ b/studio/backend/core/rag/captioner.py
@@ -128,6 +128,8 @@ def _vision_complete(
             json = payload,
             timeout = timeout,
             headers = _vision_auth_headers(),
+            # trust_env=False: base_url is the loopback backend; skip any HTTP(S)_PROXY.
+            trust_env = False,
         )
         r.raise_for_status()
         text = r.json()["choices"][0]["message"]["content"]
diff --git a/studio/backend/core/rag/embed_llama_server.py b/studio/backend/core/rag/embed_llama_server.py
index c2e4ecc740..f53478463c 100644
--- a/studio/backend/core/rag/embed_llama_server.py
+++ b/studio/backend/core/rag/embed_llama_server.py
@@ -61,9 +61,8 @@ class LlamaServerBackend:
         self._binary: str | None = None
         # Sticky after an auto GPU start fails: later spawns stay on CPU.
         self._force_cpu = False
-        # Pooled client; requests pass full URLs, so a respawn's new port needs
-        # no rebuild.
-        self._client = httpx.Client(timeout = config.EMBED_REQUEST_TIMEOUT_S)
+        # Pooled client (full URLs per request survive a respawn); trust_env=False skips HTTP(S)_PROXY.
+        self._client = httpx.Client(timeout = config.EMBED_REQUEST_TIMEOUT_S, trust_env = False)
         atexit.register(self._shutdown)
 
     @property
@@ -305,7 +304,8 @@ class LlamaServerBackend:
                 logger.error("llama-server embedder exited early (code %s)", code)
                 return False
             try:
-                if httpx.get(url, timeout = 2.0).status_code == 200:
+                # trust_env=False: a proxy that 503s 127.0.0.1 must not block this probe.
+                if httpx.get(url, timeout = 2.0, trust_env = False).status_code == 200:
                     return True
             except (*_TRANSPORT_ERRORS, httpx.TimeoutException):
                 pass
diff --git a/studio/backend/tests/test_rag_captioning.py b/studio/backend/tests/test_rag_captioning.py
index f475c9e374..5ae0926990 100644
--- a/studio/backend/tests/test_rag_captioning.py
+++ b/studio/backend/tests/test_rag_captioning.py
@@ -172,8 +172,8 @@ def test_vision_complete_sends_auth_header(monkeypatch):
         def json(self):
             return {"choices": [{"message": {"content": "ok"}}]}
 
-    def fake_post(url, *, json, timeout, headers):
-        captured.update(url = url, headers = headers)
+    def fake_post(url, *, json, timeout, headers, trust_env):
+        captured.update(url = url, headers = headers, trust_env = trust_env)
         return _Resp()
 
     monkeypatch.setattr(httpx, "post", fake_post)
@@ -182,6 +182,7 @@ def test_vision_complete_sends_auth_header(monkeypatch):
     )
     assert out == "ok"
     assert captured["headers"] == {"Authorization": "Bearer secret"}
+    assert captured["trust_env"] is False
 
 
 def test_vision_complete_omits_header_when_unauthenticated(monkeypatch):
@@ -198,13 +199,15 @@ def test_vision_complete_omits_header_when_unauthenticated(monkeypatch):
         def json(self):
             return {"choices": [{"message": {"content": "ok"}}]}
 
-    def fake_post(url, *, json, timeout, headers):
+    def fake_post(url, *, json, timeout, headers, trust_env):
         captured["headers"] = headers
+        captured["trust_env"] = trust_env
         return _Resp()
 
     monkeypatch.setattr(httpx, "post", fake_post)
     captioner._vision_complete("http://x", "local", b"i", prompt = "p", timeout = 5.0, max_tokens = 8)
     assert captured["headers"] is None
+    assert captured["trust_env"] is False
 
 
 def test_merge_page_captions_dedups():
diff --git a/studio/backend/tests/test_rag_loopback_trust_env.py b/studio/backend/tests/test_rag_loopback_trust_env.py
new file mode 100644
index 0000000000..1945e09982
--- /dev/null
+++ b/studio/backend/tests/test_rag_loopback_trust_env.py
@@ -0,0 +1,52 @@
+"""AST test locking in the RAG loopback trust_env fix: every httpx client/call in the RAG
+package (all target the local 127.0.0.1 llama-server) must set trust_env=False."""
+
+import ast
+import os
+
+RAG_DIR = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "core", "rag")
+HTTPX_CALLEES = {"get", "post", "stream", "request", "Client", "AsyncClient"}
+
+
+def _httpx_calls(path):
+    with open(path, encoding = "utf-8") as f:
+        tree = ast.parse(f.read(), filename = path)
+    calls = []
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Call):
+            continue
+        func = node.func
+        if (
+            isinstance(func, ast.Attribute)
+            and func.attr in HTTPX_CALLEES
+            and isinstance(func.value, ast.Name)
+            and func.value.id == "httpx"
+        ):
+            calls.append(node)
+    return calls
+
+
+def _sets_trust_env_false(call):
+    for kw in call.keywords:
+        if kw.arg == "trust_env" and isinstance(kw.value, ast.Constant) and kw.value.value is False:
+            return True
+    return False
+
+
+def test_rag_loopback_httpx_clients_disable_trust_env():
+    # Scan every .py in the package so a new file with an httpx call can't bypass this.
+    checked = 0
+    for fname in sorted(f for f in os.listdir(RAG_DIR) if f.endswith(".py")):
+        path = os.path.join(RAG_DIR, fname)
+        for call in _httpx_calls(path):
+            checked += 1
+            assert _sets_trust_env_false(call), (
+                f"httpx.{call.func.attr} at {fname}:{call.lineno} must set trust_env=False "
+                f"(loopback llama-server client must not honor ambient HTTP(S)_PROXY)"
+            )
+    assert checked >= 3, f"expected at least 3 loopback httpx calls, found {checked}"
+
+
+if __name__ == "__main__":
+    test_rag_loopback_httpx_clients_disable_trust_env()
+    print("OK: all RAG loopback httpx clients set trust_env=False")