diff --git a/CHANGELOG.md b/CHANGELOG.md
index aea5aea5b38..7273673d978 100755
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- `LocalValetDriver.php`, the driver Laravel Valet and Laravel Herd read from the project. Both send every `.php` URL to the front controller, so WordPress's own entry points (`/cms/wp-login.php`, `/cms/wp-admin/index.php`, `wp-cron.php`) answered the site's 404 and the admin could not be reached. The driver lets PHP run the file when it exists under `public/` (never under `uploads/`). Existing projects can copy the file to their root
 - `config/modules.php`, Pollora's modules configuration (framework v13.35.3): where a module's enabled state lives (`MODULES_CONNECTOR`, `json` by default, as before: `modules_statuses.json`), states forced by `MODULES_LOCKED_ENABLED` / `MODULES_LOCKED_DISABLED`, and who may switch modules from Plugins › Modules. nwidart/laravel-modules reads it while it registers, so these settings only apply from this file. `module:make` still writes Pollora's lean module
 - A Pollora module published as a Composer package installs into `Modules/`. `composer require pollora/<module>` places a `pollora/*` package of type `laravel-library` in `Modules/{$name}/` (`composer/installers` reads the module's `installer-name` for the folder's exact case), where nwidart finds it; enabling it is still a line in `modules_statuses.json`. The rule is limited to the `pollora` vendor: other Laravel packages that declare `laravel-library` (about ninety on Packagist) keep their usual place. The rule comes last in `installer-paths`: `composer/installers` applies the first rule that matches, and a `vendor:` rule ignores the package type, so placed first it sent Pollora's own WordPress plugins (`pollora/mcp-connector`, `pollora/ai-visibility`) to `Modules/` too. Existing projects can add the same rule, last, to their `composer.json`
 
diff --git a/LocalValetDriver.php b/LocalValetDriver.php
new file mode 100644
index 00000000000..69b798b6e24
--- /dev/null
+++ b/LocalValetDriver.php
@@ -0,0 +1,42 @@
+<?php
+
+use Valet\Drivers\LaravelValetDriver;
+
+/**
+ * Valet and Herd driver for a Pollora project.
+ *
+ * Both send every `.php` URL to the front controller, so WordPress's own entry
+ * points (wp-login.php, wp-admin/*.php, wp-cron.php, xmlrpc.php) never ran:
+ * they answered the site's 404. This driver hands them to PHP as a web server
+ * with a document root does.
+ */
+class LocalValetDriver extends LaravelValetDriver
+{
+    public function frontControllerPath(string $sitePath, string $siteName, string $uri): ?string
+    {
+        $path = parse_url($uri, PHP_URL_PATH) ?: '/';
+
+        if (str_ends_with($path, '/')) {
+            $path .= 'index.php';
+        }
+
+        $script = realpath($sitePath.'/public'.rawurldecode($path));
+        $public = realpath($sitePath.'/public');
+
+        // Never run a PHP file a visitor or a plugin put in the uploads folder
+        $inUploads = $script !== false && str_contains($script, DIRECTORY_SEPARATOR.'uploads'.DIRECTORY_SEPARATOR);
+
+        if ($script !== false && $public !== false && ! $inUploads
+            && str_starts_with($script, $public.DIRECTORY_SEPARATOR)
+            && str_ends_with($script, '.php') && is_file($script)) {
+            $_SERVER['SCRIPT_FILENAME'] = $script;
+            $_SERVER['SCRIPT_NAME'] = $path;
+            $_SERVER['PHP_SELF'] = $path;
+            $_SERVER['DOCUMENT_ROOT'] = $public;
+
+            return $script;
+        }
+
+        return parent::frontControllerPath($sitePath, $siteName, $uri);
+    }
+}