diff --git a/src/server.rs b/src/server.rs
index 4ccffd5..7d529e2 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -1,7 +1,7 @@
 use axum::{
     Json, RequestPartsExt, Router,
     extract::{FromRef, FromRequestParts, Path, Query, State},
-    http::{StatusCode, request::Parts},
+    http::{HeaderValue, StatusCode, request::Parts},
     routing::{get, post},
 };
 use axum_extra::{
@@ -14,7 +14,7 @@ use sea_orm::{
 };
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
-use tower_http::cors::{Any, CorsLayer};
+use tower_http::cors::{AllowOrigin, Any, CorsLayer};
 use uuid::Uuid;
 
 use crate::agent::Agent;
@@ -119,10 +119,7 @@ pub async fn start(db_url: &str) -> Result<(), Box<dyn std::error::Error>> {
         authenticator,
     });
 
-    let cors = CorsLayer::new()
-        .allow_origin(Any)
-        .allow_methods(Any)
-        .allow_headers(Any);
+    let cors = build_cors_layer();
 
     let app = Router::new()
         .route("/api/tasks", post(create_task).get(list_tasks))
@@ -143,6 +140,32 @@ pub async fn start(db_url: &str) -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
+fn build_cors_layer() -> CorsLayer {
+    let origins = std::env::var("CORS_ALLOWED_ORIGINS").ok();
+
+    let allow_origin = if let Some(origins) = origins {
+        let values: Vec<HeaderValue> = origins
+            .split(',')
+            .map(|origin| origin.trim())
+            .filter(|origin| !origin.is_empty())
+            .filter_map(|origin| HeaderValue::from_str(origin).ok())
+            .collect();
+
+        if values.is_empty() {
+            AllowOrigin::any()
+        } else {
+            AllowOrigin::list(values)
+        }
+    } else {
+        AllowOrigin::any()
+    };
+
+    CorsLayer::new()
+        .allow_origin(allow_origin)
+        .allow_methods(Any)
+        .allow_headers(Any)
+}
+
 async fn list_tasks(
     _user: AuthenticatedUser,
     State(state): State<Arc<AppState>>,