diff --git a/.env.production b/.env.production
index 0a48eef3..4709e26a 100644
--- a/.env.production
+++ b/.env.production
@@ -5,7 +5,7 @@ API_PORT=8081
 # Frontend domains allowed to call this API — comma-separated, no trailing slashes.
 # The frontend API base URL is set in webapp/.env.production (VITE_API_URL).
 # This server must be reachable at https://nebula.armco.dev/api/v1
-CORS_ORIGINS=https://nebula.stuffle.io,https://nebula.armco.dev
+CORS_ORIGINS=https://nebula.stuffle.io,https://nebula.stuffle.ai,https://nebula.armco.dev
 
 # Database — set via secrets manager / deploy env, not hardcoded here
 # DATABASE_URL=postgresql://...