diff --git a/.env.example b/.env.example
index 9311603..b55a826 100644
--- a/.env.example
+++ b/.env.example
@@ -1,4 +1,4 @@
 DATABASE_URL="postgresql://postgres:postgres@localhost:5432/mtc_reverse_proxy?schema=public"
 PORT=4000
-FRONTEND_ORIGIN="http://localhost:5173"
+FRONTEND_ORIGINS="http://localhost:5173,http://127.0.0.1:5173"
 REVERSE_PROXY_TIMEOUT_MS=15000
diff --git a/src/server.js b/src/server.js
index facd6f4..35d5f22 100644
--- a/src/server.js
+++ b/src/server.js
@@ -6,10 +6,20 @@ const routes = require("./routes");
 
 const app = express();
 const port = Number(process.env.PORT || 4000);
+const allowedOrigins = (process.env.FRONTEND_ORIGINS || process.env.FRONTEND_ORIGIN || "http://localhost:5173,http://127.0.0.1:5173")
+  .split(",")
+  .map((origin) => origin.trim())
+  .filter(Boolean);
 
 app.use(
   cors({
-    origin: process.env.FRONTEND_ORIGIN || "http://localhost:5173",
+    origin(origin, callback) {
+      if (!origin || allowedOrigins.includes(origin)) {
+        callback(null, true);
+        return;
+      }
+      callback(new Error(`CORS origin not allowed: ${origin}`));
+    },
   }),
 );
 app.use(express.json({ limit: "2mb" }));