diff --git a/.github/workflows/build-host.yml b/.github/workflows/build-host.yml
index 447bb84833..fffc17add1 100644
--- a/.github/workflows/build-host.yml
+++ b/.github/workflows/build-host.yml
@@ -24,6 +24,7 @@ jobs:
         env:
           INPUT_ENVIRONMENT: ${{ inputs.environment }}
         run: |
+          echo "ICONS_URL=https://boxel-icons.boxel.ai" >> $GITHUB_ENV
           if [ "$INPUT_ENVIRONMENT" = "production" ]; then
             echo "RESOLVED_BASE_REALM_URL=https://app.boxel.ai/base/" >> $GITHUB_ENV
             echo "RESOLVED_CATALOG_REALM_URL=https://app.boxel.ai/catalog/" >> $GITHUB_ENV
diff --git a/README.md b/README.md
index 78df2864ab..ecbce14b30 100644
--- a/README.md
+++ b/README.md
@@ -82,6 +82,7 @@ Instead of running `pnpm start:base`, you can alternatively use `pnpm start:all`
 | :4201 | `/experiments` experiments realm                                                              | ✅                  | 🚫                   |
 | :4202 | `/test` host test realm, `/node-test` node test realm                                         | ✅                  | 🚫                   |
 | :4205 | `/test` realm for matrix client tests (playwright controlled)                                 | 🚫                  | 🚫                   |
+| :4206 | Boxel icons server                                                                            | ✅                  | 🚫                   |
 | :4210 | Development Worker Manager (spins up 1 worker by default)                                     | ✅                  | 🚫                   |
 | :4211 | Test Worker Manager (spins up 1 worker by default)                                            | ✅                  | 🚫                   |
 | :4212 | Worker Manager for matrix client tests (playwright controlled - 1 worker)                     | ✅                  | 🚫                   |
diff --git a/packages/boxel-icons/README.md b/packages/boxel-icons/README.md
index 29c902968a..5e43491a4f 100644
--- a/packages/boxel-icons/README.md
+++ b/packages/boxel-icons/README.md
@@ -17,3 +17,4 @@ The [BoxelUI preview app](https://boxel-ui.stack.cards) contains a preview of al
 ## Local Development
 
 `pnpm serve` in this directory starts a local webserver. You can point `host` at it by setting ICONS_URL=http://localhost:4206.
+The server includes CORS headers for `Authorization` and `X-Boxel-Assume-User` so host-side authenticated icon fetches work in local dev.
diff --git a/packages/boxel-icons/package.json b/packages/boxel-icons/package.json
index c52f60be29..8bf82ab587 100644
--- a/packages/boxel-icons/package.json
+++ b/packages/boxel-icons/package.json
@@ -28,7 +28,7 @@
     "start": "concurrently \"pnpm:start:*\" --names \"start:\"",
     "start:js": "rollup --config --watch --no-watch.clearScreen",
     "start:types": "glint --declaration --watch",
-    "serve": "http-server --cors --port 4206 dist",
+    "serve": "http-server --cors=Origin,X-Requested-With,Content-Type,Accept,Range,Authorization,X-Boxel-Assume-User --port 4206 dist",
     "test": "echo 'A v2 addon does not have tests, run tests in test-app'",
     "test:ember": "ember test"
   },
diff --git a/packages/host/config/environment.js b/packages/host/config/environment.js
index 74779893ac..9a05970287 100644
--- a/packages/host/config/environment.js
+++ b/packages/host/config/environment.js
@@ -48,7 +48,7 @@ module.exports = function (environment) {
     fileSizeLimitBytes: Number(
       process.env.FILE_SIZE_LIMIT_BYTES ?? DEFAULT_FILE_SIZE_LIMIT_BYTES,
     ),
-    iconsURL: process.env.ICONS_URL || 'https://boxel-icons.boxel.ai',
+    iconsURL: process.env.ICONS_URL || 'http://localhost:4206',
     publishedRealmBoxelSpaceDomain:
       process.env.PUBLISHED_REALM_BOXEL_SPACE_DOMAIN || 'localhost:4201',
     publishedRealmBoxelSiteDomain:
diff --git a/packages/host/tests/integration/realm-indexing-test.gts b/packages/host/tests/integration/realm-indexing-test.gts
index 359f36fabf..6c731fe4f4 100644
--- a/packages/host/tests/integration/realm-indexing-test.gts
+++ b/packages/host/tests/integration/realm-indexing-test.gts
@@ -4125,23 +4125,23 @@ module(`Integration | realm indexing`, function (hooks) {
         .filter((ref) => !ref.includes('glimmer-scoped.css')),
       [
         'http://localhost:4202/test/person',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/align-box-left-middle',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/align-left',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/arrow-left',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/captions',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/code',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/eye',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/file-pencil',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/folder-pen',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/hash',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/import',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/letter-case',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/link',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/notepad-text',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/palette',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/rectangle-ellipsis',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/trash-2',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/wand',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/align-box-left-middle',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/align-left',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/arrow-left',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/captions',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/code',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/eye',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/file-pencil',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/folder-pen',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/hash',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/import',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/letter-case',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/link',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/notepad-text',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/palette',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/rectangle-ellipsis',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/trash-2',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/wand',
         'https://cardstack.com/base/-private',
         'https://cardstack.com/base/card-api',
         'https://cardstack.com/base/card-serialization',
@@ -4248,31 +4248,31 @@ module(`Integration | realm indexing`, function (hooks) {
         .filter((ref) => !ref.includes('glimmer-scoped.css')),
       [
         'http://localhost:4202/test/person',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/align-box-left-middle',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/align-left',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/apps',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/arrow-left',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/book-open-text',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/box-model',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/captions',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/code',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/eye',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/file-pencil',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/folder-pen',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/git-branch',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/hash',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/import',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/layers-subtract',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/layout-list',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/letter-case',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/link',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/notepad-text',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/palette',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/rectangle-ellipsis',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/stack',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/toggle-left',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/trash-2',
-        'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons/wand',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/align-box-left-middle',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/align-left',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/apps',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/arrow-left',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/book-open-text',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/box-model',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/captions',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/code',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/eye',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/file-pencil',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/folder-pen',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/git-branch',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/hash',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/import',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/layers-subtract',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/layout-list',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/letter-case',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/link',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/notepad-text',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/palette',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/rectangle-ellipsis',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/stack',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/toggle-left',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/trash-2',
+        'http://localhost:4206/@cardstack/boxel-icons/v1/icons/wand',
         'https://cardstack.com/base/-private',
         'https://cardstack.com/base/boolean',
         'https://cardstack.com/base/card-api',
diff --git a/packages/realm-server/package.json b/packages/realm-server/package.json
index 501aaddaf6..aeca97f908 100644
--- a/packages/realm-server/package.json
+++ b/packages/realm-server/package.json
@@ -90,6 +90,7 @@
     "test-module": "./scripts/remove-test-dbs.sh; LOG_LEVELS=\"*=error,prerenderer-chrome=silent,pg-adapter=warn,realm:requests=warn${LOG_LEVELS:+,}${LOG_LEVELS}\" NODE_NO_WARNINGS=1 PGPORT=5435 STRIPE_WEBHOOK_SECRET=stripe-webhook-secret STRIPE_API_KEY=stripe-api-key qunit --require ts-node/register/transpile-only --module ${TEST_MODULE} tests/index.ts",
     "start:matrix": "cd ../matrix && pnpm assert-synapse-running",
     "start:smtp": "cd ../matrix && pnpm assert-smtp-running",
+    "start:icons": "sh ./scripts/start-icons.sh",
     "start:pg": "./scripts/start-pg.sh",
     "stop:pg": "./scripts/stop-pg.sh",
     "test:wait-for-servers": "WAIT_ON_TIMEOUT=900000 NODE_NO_WARNINGS=1 start-server-and-test 'pnpm run wait' 'http-get://localhost:4201/base/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson' 'pnpm run wait' 'http-get://localhost:4202/node-test/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson|http://localhost:8008|http://localhost:5001' 'test-module'",
diff --git a/packages/realm-server/scripts/start-all-except-optional.sh b/packages/realm-server/scripts/start-all-except-optional.sh
index 1e196cbaf0..e811916217 100755
--- a/packages/realm-server/scripts/start-all-except-optional.sh
+++ b/packages/realm-server/scripts/start-all-except-optional.sh
@@ -2,7 +2,7 @@
 
 WAIT_ON_TIMEOUT=900000 SKIP_EXPERIMENTS=true SKIP_CATALOG=true SKIP_BOXEL_HOMEPAGE=true SKIP_SUBMISSION=true NODE_NO_WARNINGS=1 start-server-and-test \
   'run-p -ln start:pg start:prerender-dev start:prerender-manager-dev start:matrix start:smtp start:worker-development start:development' \
-  'http-get://localhost:4201/base/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson|http://localhost:8008|http://localhost:5001' \
+  'http-get://localhost:4201/base/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson|http://localhost:8008|http://localhost:5001|http://localhost:4206' \
   'run-p -ln start:worker-test start:test-realms' \
   'http-get://localhost:4202/node-test/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson' \
   'wait'
diff --git a/packages/realm-server/scripts/start-all.sh b/packages/realm-server/scripts/start-all.sh
index 858562aa50..93d6de32f8 100755
--- a/packages/realm-server/scripts/start-all.sh
+++ b/packages/realm-server/scripts/start-all.sh
@@ -18,10 +18,11 @@ NODE_TEST_REALM_READY="$NODE_TEST_REALM$READY_PATH"
 
 SYNAPSE_URL="http://localhost:8008"
 SMTP_4_DEV_URL="http://localhost:5001"
+ICONS_URL="http://localhost:4206"
 
 WAIT_ON_TIMEOUT=1200000 NODE_NO_WARNINGS=1 start-server-and-test \
   'run-p -ln start:pg start:matrix start:smtp start:prerender-dev start:prerender-manager-dev start:worker-development start:development' \
-  "$BASE_REALM_READY|$CATALOG_REALM_READY|$SKILLS_REALM_READY|$BOXEL_HOMEPAGE_REALM_READY|$EXPERIMENTS_REALM_READY|$SYNAPSE_URL|$SMTP_4_DEV_URL" \
+  "$BASE_REALM_READY|$CATALOG_REALM_READY|$SKILLS_REALM_READY|$BOXEL_HOMEPAGE_REALM_READY|$EXPERIMENTS_REALM_READY|$SYNAPSE_URL|$SMTP_4_DEV_URL|$ICONS_URL" \
   'run-p -ln start:worker-test start:test-realms' \
   "$NODE_TEST_REALM_READY" \
   'wait'
diff --git a/packages/realm-server/scripts/start-development.sh b/packages/realm-server/scripts/start-development.sh
index 7b3fae2703..024c582a1a 100755
--- a/packages/realm-server/scripts/start-development.sh
+++ b/packages/realm-server/scripts/start-development.sh
@@ -2,6 +2,15 @@
 SCRIPTS_DIR="$(cd "$(dirname "$0")" && pwd)"
 . "$SCRIPTS_DIR/wait-for-pg.sh"
 
+sh "$SCRIPTS_DIR/start-icons.sh" &
+ICONS_PID=$!
+cleanup_icons_server() {
+  if [ -n "$ICONS_PID" ]; then
+    kill "$ICONS_PID" >/dev/null 2>&1 || true
+  fi
+}
+trap cleanup_icons_server EXIT INT TERM
+
 wait_for_postgres
 
 pnpm --dir=../skills-realm skills:setup
diff --git a/packages/realm-server/scripts/start-icons.sh b/packages/realm-server/scripts/start-icons.sh
new file mode 100644
index 0000000000..a6870e8691
--- /dev/null
+++ b/packages/realm-server/scripts/start-icons.sh
@@ -0,0 +1,8 @@
+#! /bin/sh
+
+if curl --fail --silent --show-error http://localhost:4206 >/dev/null 2>&1; then
+  echo "icons server already running on http://localhost:4206, skipping startup"
+  exit 0
+fi
+
+pnpm --dir=../boxel-icons serve
diff --git a/packages/realm-server/scripts/start-services-for-host-tests.sh b/packages/realm-server/scripts/start-services-for-host-tests.sh
index a3cce48f8b..2939192a72 100755
--- a/packages/realm-server/scripts/start-services-for-host-tests.sh
+++ b/packages/realm-server/scripts/start-services-for-host-tests.sh
@@ -63,7 +63,7 @@ WAIT_ON_TIMEOUT=900000 \
   NODE_NO_WARNINGS=1 \
   start-server-and-test \
     'run-p -ln start:pg start:prerender-dev start:prerender-manager-dev start:matrix start:smtp start:worker-development start:development' \
-    'http-get://localhost:4201/base/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson|http://localhost:8008|http://localhost:5001' \
+    'http-get://localhost:4201/base/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson|http://localhost:8008|http://localhost:5001|http://localhost:4206' \
     'run-p -ln start:worker-test start:test-realms' \
     'http-get://localhost:4202/node-test/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson' \
     'wait'
diff --git a/packages/realm-server/scripts/start-services-for-matrix-tests.sh b/packages/realm-server/scripts/start-services-for-matrix-tests.sh
index 78a0eb980e..914abe5553 100755
--- a/packages/realm-server/scripts/start-services-for-matrix-tests.sh
+++ b/packages/realm-server/scripts/start-services-for-matrix-tests.sh
@@ -9,5 +9,5 @@ pnpm --dir=../skills-realm skills:setup
 WAIT_ON_TIMEOUT=600000 NODE_NO_WARNINGS=1 SKIP_SUBMISSION=true \
   start-server-and-test \
     'run-p -ln start:pg start:prerender-dev start:prerender-manager-dev start:worker-base start:base' \
-    'http-get://localhost:4201/base/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson' \
+    'http-get://localhost:4201/base/_readiness-check?acceptHeader=application%2Fvnd.api%2Bjson|http://localhost:4206' \
     'wait'
diff --git a/packages/realm-server/scripts/start-test-realms.sh b/packages/realm-server/scripts/start-test-realms.sh
index 65f26ef47c..70daa8d60f 100755
--- a/packages/realm-server/scripts/start-test-realms.sh
+++ b/packages/realm-server/scripts/start-test-realms.sh
@@ -2,6 +2,15 @@
 SCRIPTS_DIR="$(cd "$(dirname "$0")" && pwd)"
 . "$SCRIPTS_DIR/wait-for-pg.sh"
 
+sh "$SCRIPTS_DIR/start-icons.sh" &
+ICONS_PID=$!
+cleanup_icons_server() {
+  if [ -n "$ICONS_PID" ]; then
+    kill "$ICONS_PID" >/dev/null 2>&1 || true
+  fi
+}
+trap cleanup_icons_server EXIT INT TERM
+
 wait_for_postgres
 PRERENDER_URL="${PRERENDER_URL:-http://localhost:4221}"
 
diff --git a/packages/realm-server/scripts/start-without-matrix.sh b/packages/realm-server/scripts/start-without-matrix.sh
index 77f75b7a42..10e750aa2b 100755
--- a/packages/realm-server/scripts/start-without-matrix.sh
+++ b/packages/realm-server/scripts/start-without-matrix.sh
@@ -14,10 +14,11 @@ TEST_REALM_READY="$TEST_REALM$READY_PATH"
 
 SYNAPSE_URL="http://localhost:8008"
 SMTP_4_DEV_URL="http://localhost:5001"
+ICONS_URL="http://localhost:4206"
 
 WAIT_ON_TIMEOUT=900000 SKIP_BOXEL_HOMEPAGE=true NODE_NO_WARNINGS=1 start-server-and-test \
   'run-p start:pg start:prerender-dev start:prerender-manager-dev start:worker-development start:development' \
-  "$BASE_REALM_READY|$EXPERIMENTS_REALM_READY|$SYNAPSE_URL|$SMTP_4_DEV_URL" \
+  "$BASE_REALM_READY|$EXPERIMENTS_REALM_READY|$SYNAPSE_URL|$SMTP_4_DEV_URL|$ICONS_URL" \
   'run-p start:worker-test start:test-realms' \
   "$NODE_TEST_REALM_READY" \
   'wait'