diff --git a/react-router.config.ts b/react-router.config.ts
index e45e273..821b238 100644
--- a/react-router.config.ts
+++ b/react-router.config.ts
@@ -2,4 +2,8 @@ import type { Config } from "@react-router/dev/config";
 
 export default {
   ssr: true,
+  // Behind Nginx/Caddy the Node server sees http://, while the browser's Origin is https://, so
+  // React Router's CSRF check rejects every form action (400 Bad Request). List the hosts that may
+  // post: production, and the Shopify CLI dev tunnels.
+  allowedActionOrigins: ["datewise.metatronlabz.com", "*.trycloudflare.com"],
 } satisfies Config;