diff --git a/.env.example b/.env.example
index 60227e4..9314990 100644
--- a/.env.example
+++ b/.env.example
@@ -4,6 +4,7 @@ DATABASE_URL=postgresql://postgres:postgres@localhost:5432/whats_drive?schema=pu
 JWT_SECRET=replace-with-at-least-32-random-characters
 JWT_EXPIRES_IN=7d
 CORS_ORIGINS=*
+ADMIN_PANEL_ORIGIN=https://metatron-drive.thedomainnest.com
 MAX_UPLOAD_MB=250
 GOOGLE_CREDENTIALS=./credentials.json
 GOOGLE_TOKEN=./token.json
diff --git a/src/config.js b/src/config.js
index ead7088..429e4a7 100644
--- a/src/config.js
+++ b/src/config.js
@@ -10,6 +10,7 @@ const schema = z.object({
   JWT_SECRET: z.string().min(32),
   JWT_EXPIRES_IN: z.string().default("7d"),
   CORS_ORIGINS: z.string().default("*"),
+  ADMIN_PANEL_ORIGIN: z.string().url().default("https://metatron-drive.thedomainnest.com"),
   MAX_UPLOAD_MB: z.coerce.number().positive().default(250),
   GOOGLE_CREDENTIALS: z.string().default("./credentials.json"),
   GOOGLE_TOKEN: z.string().default("./token.json"),
@@ -34,5 +35,8 @@ export const config = {
   uploadDirectory: path.resolve(projectRoot, "uploads", "tmp"),
   corsOrigins: parsed.data.CORS_ORIGINS === "*"
     ? "*"
-    : parsed.data.CORS_ORIGINS.split(",").map((value) => value.trim()).filter(Boolean),
+    : [...new Set([
+      ...parsed.data.CORS_ORIGINS.split(",").map((value) => value.trim()).filter(Boolean),
+      parsed.data.ADMIN_PANEL_ORIGIN,
+    ])],
 };