diff --git a/crmbackend.nginx.conf b/crmbackend.nginx.conf
index 2f6f351..9aa5dfd 100644
--- a/crmbackend.nginx.conf
+++ b/crmbackend.nginx.conf
@@ -1,6 +1,6 @@
 server {
     listen 80;
-    server_name crmbackend.local;
+    server_name betaapicsa.tradhox.com apicsa.tradhox.com crmbackend.local;
 
     location / {
         proxy_pass http://127.0.0.1:8081;
diff --git a/digihoxbackend/settings.py b/digihoxbackend/settings.py
index ffaf0b1..4834f08 100644
--- a/digihoxbackend/settings.py
+++ b/digihoxbackend/settings.py
@@ -127,4 +127,38 @@ REST_FRAMEWORK = {
     ),
 }
 
-CORS_ALLOW_ALL_ORIGINS = True  # Admin WireGuard VPN only; safe for development
+CORS_ALLOW_ALL_ORIGINS = True
+CORS_ALLOW_CREDENTIALS = True
+
+CORS_ALLOWED_ORIGINS = [
+    'https://betacsa.tradhox.com',
+    'https://csa.tradhox.com',
+    'http://localhost:5173',
+    'http://localhost:3000',
+]
+
+CORS_ALLOWED_ORIGIN_REGEXES = [
+    r"^https://.*\.tradhox\.com$",
+    r"^http://localhost:\d+$",
+]
+
+CORS_ALLOW_HEADERS = [
+    'accept',
+    'accept-encoding',
+    'authorization',
+    'content-type',
+    'dnt',
+    'origin',
+    'user-agent',
+    'x-csrftoken',
+    'x-requested-with',
+]
+
+CORS_ALLOW_METHODS = [
+    'DELETE',
+    'GET',
+    'OPTIONS',
+    'PATCH',
+    'POST',
+    'PUT',
+]