diff --git a/apps/edr-passenger-api/.env.example b/apps/edr-passenger-api/.env.example
index aaed09659..fcca698e9 100644
--- a/apps/edr-passenger-api/.env.example
+++ b/apps/edr-passenger-api/.env.example
@@ -28,9 +28,8 @@ MINIO_ACCESS_KEY=minioadmin
 MINIO_SECRET_KEY=minioadmin
 MINIO_BUCKET=edr-dev
 
-# CORS
-FRONTEND_URL=http://localhost:5174
-BACK_OFFICE_URL=http://localhost:5184
+# CORS — comma-separated list of allowed origins (add more, comma-separated)
+CORS_ORIGINS=http://localhost:5174,http://localhost:5184
 
 # JWT (legacy passenger auth — being replaced by IAM)
 # REQUIRED in production — use a random 32+ character string (e.g. openssl rand -hex 32)
diff --git a/apps/edr-passenger-api/src/main.ts b/apps/edr-passenger-api/src/main.ts
index 26f57e506..1715d1ba3 100644
--- a/apps/edr-passenger-api/src/main.ts
+++ b/apps/edr-passenger-api/src/main.ts
@@ -33,11 +33,16 @@ async function bootstrap() {
   // version-neutral at their existing paths (e.g. /search, /bookings) — unchanged for the frontend.
   app.enableVersioning({ type: VersioningType.URI });
 
+  // Allowed CORS origins come from a single comma-separated env var (CORS_ORIGINS),
+  // e.g. "https://portal.edr.et,https://backoffice.edr.et". Whitespace around each
+  // entry is trimmed and empties are dropped. Falls back to the local dev ports.
+  const corsOrigins = (process.env.CORS_ORIGINS ?? "http://localhost:5174,http://localhost:5184")
+    .split(",")
+    .map((origin) => origin.trim())
+    .filter((origin) => origin.length > 0);
+
   app.enableCors({
-    origin: [
-      process.env.PORTAL_URL ?? "http://localhost:5174",
-      process.env.BACK_OFFICE_URL ?? "http://localhost:5184",
-    ],
+    origin: corsOrigins,
     methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
     allowedHeaders: ['Content-Type', 'Authorization', 'Accept-Language', 'X-Request-ID'],
     credentials: true,