diff --git a/.env.production b/.env.production
index 3871868..0a48eef 100644
--- a/.env.production
+++ b/.env.production
@@ -2,7 +2,10 @@
 # Backend
 API_HOST=0.0.0.0
 API_PORT=8081
-CORS_ORIGINS=https://nebula.stuffle.io
+# Frontend domains allowed to call this API — comma-separated, no trailing slashes.
+# The frontend API base URL is set in webapp/.env.production (VITE_API_URL).
+# This server must be reachable at https://nebula.armco.dev/api/v1
+CORS_ORIGINS=https://nebula.stuffle.io,https://nebula.armco.dev
 
 # Database — set via secrets manager / deploy env, not hardcoded here
 # DATABASE_URL=postgresql://...