diff --git a/apps/edr-freight-api/src/main.ts b/apps/edr-freight-api/src/main.ts
index cf4c37b2d..5b027448c 100644
--- a/apps/edr-freight-api/src/main.ts
+++ b/apps/edr-freight-api/src/main.ts
@@ -2,7 +2,6 @@ import "reflect-metadata";
 import * as dotenv from "dotenv";
 dotenv.config();
 import { NestFactory } from "@nestjs/core";
-import type { NestExpressApplication } from "@nestjs/platform-express";
 import { DocumentBuilder, SwaggerModule } from "@nestjs/swagger";
 import {
   HttpExceptionFilter,
@@ -12,25 +11,8 @@ import {
 
 import { AppModule } from "./app.module";
 
-/**
- * JSON body ceiling. Signing posts the signature AND the company stamp as
- * base64 in one JSON body, and base64 inflates bytes by ~4/3 — a 10MB stamp is
- * ~13.4MB on the wire. Express defaults to 100kb, which rejected any real stamp
- * image with a 413 "request entity too large".
- */
-const JSON_BODY_LIMIT = '20mb';
-
 async function bootstrap() {
-  const app = await NestFactory.create<NestExpressApplication>(AppModule);
-
-  // Nest's own body-parser API, NOT `app.use(json(...))` from express: express
-  // is not a declared dependency of this app (it arrives under
-  // @nestjs/platform-express), so importing it directly resolved only through
-  // pnpm's hoisted dev store and died as MODULE_NOT_FOUND in the production
-  // image, where `pnpm deploy --prod` installs declared dependencies only.
-  // This also RECONFIGURES the default parsers rather than racing them.
-  app.useBodyParser('json', { limit: JSON_BODY_LIMIT });
-  app.useBodyParser('urlencoded', { limit: JSON_BODY_LIMIT, extended: true });
+  const app = await NestFactory.create(AppModule);
 
   // Dev CORS: reflect any localhost origin and allow credentials so the
   // freight portal (5173), passenger portal (5174), backoffices (5183/5184)
@@ -46,9 +28,6 @@ async function bootstrap() {
       "Accept",
       "Authorization",
       "X-Requested-With",
-      // Which freight frontend is calling — /auth/login uses this to reject
-      // cross-audience credentials (EDRFREIGHT-415).
-      "X-Client-App",
       // IAM context headers required by @tria-plc/api-common's JwtGuard
       "organization-unit-id",
       "delegator-position-id",
@@ -61,13 +40,6 @@ async function bootstrap() {
       "x-delegator-position-id",
       "x-current-project-id",
       "x-current-position-id",
-      // Headers sent by the freight-backoffice OKR/objective-service client
-      // (withHeaders.tsx, signatureAndTeeterService.ts, useIncomingReport.ts)
-      // under yet another naming convention — unprefixed "tenant-key"/"unit-id",
-      // and "x-delegated-position-id" (delegated, not delegator).
-      "tenant-key",
-      "unit-id",
-      "x-delegated-position-id",
     ],
     exposedHeaders: ["Content-Disposition"],
     maxAge: 86400, // cache preflight for 24h to cut chatter in dev