diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index e244f50..d4451c1 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -34,8 +34,11 @@ jwt.secret=${UDYAM_JWT_SECRET:55647961_6D4C_696E_6320_4E41_4241_5244_5F32_3032_3
 # 24 hours
 jwt.expiration=86400000
 
-# The Vite dev server for UdyamLinc-UI (5180 is BharatLinc)
-udyam.cors.allowed-origins=http://localhost:5182,http://127.0.0.1:5182,http://localhost:4173
+# The Vite dev server for UdyamLinc-UI (5180 is BharatLinc). A deployment must
+# add its own UI origin via UDYAM_CORS_ALLOWED_ORIGINS — this list is exhaustive,
+# so an origin missing from it fails in the browser as an opaque network error
+# with a healthy-looking backend behind it.
+udyam.cors.allowed-origins=${UDYAM_CORS_ALLOWED_ORIGINS:http://localhost:5182,http://127.0.0.1:5182,http://localhost:4173}
 
 # Forecast horizon in months — the deck's 3–6 month early-warning window
 udyam.forecast.horizon-months=6