diff --git a/.env.template b/.env.template
index f27c81f5..cb11ed62 100644
--- a/.env.template
+++ b/.env.template
@@ -276,6 +276,13 @@ LLM_OPENAI_API_KEY=your-api-key-here
 # CACHE_DEFAULT_TTL_SECONDS=300
 # CACHE_DEFAULT_LOCK_TTL_SECONDS=5
 
+# =============================================================================
+# CORS Settings
+# =============================================================================
+# JSON array of origins allowed by the FastAPI CORSMiddleware. Defaults match
+# the previously hardcoded list: localhost, 127.0.0.1:8000 and api.honcho.dev.
+# CORS_ORIGINS=["http://localhost","http://127.0.0.1:8000","https://api.honcho.dev"]
+
 # =============================================================================
 # Vector Store Settings
 # =============================================================================
diff --git a/src/config.py b/src/config.py
index b435daa0..0fc9b55e 100644
--- a/src/config.py
+++ b/src/config.py
@@ -1305,6 +1305,13 @@ class AppSettings(HonchoSettings):
     LANGFUSE_HOST: str | None = None
     LANGFUSE_PUBLIC_KEY: str | None = None
 
+    # Origins allowed by the FastAPI CORSMiddleware
+    CORS_ORIGINS: list[str] = [
+        "http://localhost",
+        "http://127.0.0.1:8000",
+        "https://api.honcho.dev",
+    ]
+
     COLLECT_METRICS_LOCAL: bool = False
     LOCAL_METRICS_FILE: str = "metrics.jsonl"
     REASONING_TRACES_FILE: str | None = None  # Path to JSONL file for reasoning traces
diff --git a/src/main.py b/src/main.py
index a5b429ce..f38946df 100644
--- a/src/main.py
+++ b/src/main.py
@@ -183,15 +183,9 @@ app = FastAPI(
     },
 )
 
-origins = [
-    "http://localhost",
-    "http://127.0.0.1:8000",
-    "https://api.honcho.dev",
-]
-
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origins=settings.CORS_ORIGINS,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],