diff --git a/.env.example b/.env.example
index b82560a..7b52cb4 100644
--- a/.env.example
+++ b/.env.example
@@ -103,6 +103,8 @@ USER_GROUP_BIRTHDAY=1
 DASHBOARD_BASE_URL=https://dash.laecloud.com
 DASHBOARD_BIRTHDAY_PATH=/birthdays
 
+CORS_ORIGINS=${DASHBOARD_BASE_URL},https://web.laecloud.com,http://localhost:5173
+
 # 可信代理，用于获取真实 IP。多个 IP 用逗号分隔。
 TRUSTED_PROXIES=
 
diff --git a/config/cors.php b/config/cors.php
index 66307e5..4e876ad 100644
--- a/config/cors.php
+++ b/config/cors.php
@@ -1,10 +1,6 @@
 <?php
 
-$allowed_origins = [
-    'http://127.0.0.1:5173',
-    'http://localhost:5173',
-    env('DASHBOARD_BASE_URL'),
-];
+$cors_origin = explode(',', env('CORS_ORIGINS'));
 
 return [
 
@@ -25,7 +21,7 @@
 
     'allowed_methods' => ['*'],
 
-    'allowed_origins' => $allowed_origins,
+    'allowed_origins' => $cors_origin,
 
     'allowed_origins_patterns' => [],