diff --git a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
index 7cc86ad1..a24ddf93 100644
--- a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
@@ -1 +1 @@
-666
+667
diff --git a/src/Backend/AutopilotMonitor.Functions/Middleware/CorsMiddleware.cs b/src/Backend/AutopilotMonitor.Functions/Middleware/CorsMiddleware.cs
index abf9e34c..9d8c8de7 100644
--- a/src/Backend/AutopilotMonitor.Functions/Middleware/CorsMiddleware.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Middleware/CorsMiddleware.cs
@@ -16,9 +16,9 @@ public class CorsMiddleware : IFunctionsWorkerMiddleware
 
     public CorsMiddleware()
     {
-        var origins = Environment.GetEnvironmentVariable("WEBSITE_CORS_ALLOWED_ORIGINS")
-            ?? Environment.GetEnvironmentVariable("Host__CORS")
-            ?? "";
+        // Read from custom App Setting (set in Azure Portal → Configuration → Application settings)
+        // Format: comma-separated origins, e.g. "https://www.autopilotmonitor.com,https://example.com"
+        var origins = Environment.GetEnvironmentVariable("CORS_ALLOWED_ORIGINS") ?? "";
 
         _allowedOrigins = new HashSet<string>(
             origins.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries),