diff --git a/.env.example b/.env.example
index 4c80048..726a708 100644
--- a/.env.example
+++ b/.env.example
@@ -1,7 +1,7 @@
 DEPLOY_IMAGE=pk-lab-server:local
 POSTGRES_PASSWORD=replace-with-a-long-random-value
 PUBLIC_BASE_URL=
-CORS_ORIGINS=http://localhost:3000,http://localhost:3002
+CORS_ORIGINS=
 TEST_AUTH_ENABLED=false
 XHS_HUB_APP_ID=
 XHS_HUB_APP_SECRET=
diff --git a/.gitea/workflows/docker-deploy.yml b/.gitea/workflows/docker-deploy.yml
index caeb5e3..819c22b 100644
--- a/.gitea/workflows/docker-deploy.yml
+++ b/.gitea/workflows/docker-deploy.yml
@@ -21,7 +21,7 @@ jobs:
       SOURCE_REPOSITORY: ${{ gitea.repository }}
       SOURCE_REVISION: ${{ gitea.sha }}
       PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL || '' }}
-      CORS_ORIGINS: ${{ vars.CORS_ORIGINS || 'http://localhost:3000,http://localhost:3002' }}
+      CORS_ORIGINS: ${{ vars.CORS_ORIGINS || '' }}
       TEST_AUTH_ENABLED: ${{ vars.TEST_AUTH_ENABLED || 'true' }}
       POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
       XHS_HUB_APP_ID: ${{ secrets.XHS_HUB_APP_ID }}
diff --git a/compose.yml b/compose.yml
index 6e71339..c67d46b 100644
--- a/compose.yml
+++ b/compose.yml
@@ -30,7 +30,7 @@ services:
     environment:
       DATABASE_URL: postgresql+psycopg://pk_lab:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}@postgres:5432/pk_lab
       PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-}
-      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000,http://localhost:3002}
+      CORS_ORIGINS: ${CORS_ORIGINS:-}
       TEST_AUTH_ENABLED: ${TEST_AUTH_ENABLED:-false}
       XHS_HUB_APP_ID: ${XHS_HUB_APP_ID:-}
       XHS_HUB_APP_SECRET: ${XHS_HUB_APP_SECRET:-}
diff --git a/docs/architecture.md b/docs/architecture.md
index c997c52..d40bd2f 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -46,7 +46,7 @@ Variables：
 
 ### 两个前端
 
-综合版默认 `DEPLOY_PORT=3000`，独立版默认 `DEPLOY_PORT=3002`。预览默认使用同源 `/api`，无需配置 `API_BASE_URL`；仅跨域部署时覆盖该变量。
+综合版默认 `DEPLOY_PORT=3000`，独立版默认 `DEPLOY_PORT=3002`。预览固定使用同源 `/api`，不需要 `API_BASE_URL` 或 CORS 配置。
 
 ## 永久运行保证
 
diff --git a/src/pk_lab_server/config.py b/src/pk_lab_server/config.py
index 8bc4e9c..c0e11d8 100644
--- a/src/pk_lab_server/config.py
+++ b/src/pk_lab_server/config.py
@@ -9,7 +9,7 @@ class Settings(BaseSettings):
 
     database_url: str = "sqlite:///./pk-lab.db"
     session_ttl_seconds: int = 60 * 60 * 24 * 30
-    cors_origins: str = "http://localhost:3000,http://localhost:3002"
+    cors_origins: str = ""
     public_base_url: str = ""
     test_auth_enabled: bool = False
     xhs_token_url: str = "https://miniapp.xiaohongshu.com/api/rmp/token"