diff --git a/infra/backend/README.md b/infra/backend/README.md
index 23ba6cd..d3d8daf 100644
--- a/infra/backend/README.md
+++ b/infra/backend/README.md
@@ -87,9 +87,12 @@ Before the first deployment, provide:
 5. A rollback and restore point before any migrated production data is imported.
 6. A separately generated `MEDIA_SIGNING_SECRET` (at least 32 characters) and
    the HTTPS API origin as `MEDIA_PUBLIC_BASE_URL`.
-7. The public web origin is fixed to `https://sauci.app` by
-   `CORS_ALLOWED_ORIGINS` in the Compose contract. Do not broaden it without a
-   reviewed browser client requirement.
+7. Browser origins are fixed by `CORS_ALLOWED_ORIGINS` in the Compose contract:
+   `https://sauci.app` (public web) and `https://manage.sauci.app` (admin
+   console, which calls `/v1/admin/*` with a bearer token). Do not broaden the
+   list without a reviewed browser client requirement, and add any new admin
+   host here rather than as a Dokploy override, so the allowlist stays
+   reviewable in git.
 8. A non-production hosted Auth project and disposable, onboarding-complete test
    identities mapped into the staging database for authenticated mobile acceptance.
 
diff --git a/infra/backend/compose.production.yaml b/infra/backend/compose.production.yaml
index bc29ed9..ee1ae4a 100644
--- a/infra/backend/compose.production.yaml
+++ b/infra/backend/compose.production.yaml
@@ -8,7 +8,8 @@ x-common-environment: &common-environment
 x-api-environment: &api-environment
   <<: *common-environment
   PORT: 3003
-  CORS_ALLOWED_ORIGINS: https://sauci.app
+  # https://manage.sauci.app is the admin console; it calls /v1/admin/* from the browser.
+  CORS_ALLOWED_ORIGINS: https://sauci.app,https://manage.sauci.app
   DATABASE_POOL_MAX: ${API_DATABASE_POOL_MAX:-10}
   DATABASE_POOL_IDLE_TIMEOUT_MS: ${DATABASE_POOL_IDLE_TIMEOUT_MS:-30000}
   DATABASE_POOL_CONNECTION_TIMEOUT_MS: ${DATABASE_POOL_CONNECTION_TIMEOUT_MS:-10000}