diff --git a/services/caddy/Caddyfile b/services/caddy/Caddyfile
index 84838959..d55054ab 100644
--- a/services/caddy/Caddyfile
+++ b/services/caddy/Caddyfile
@@ -7,14 +7,27 @@
     encode gzip
     root * /var/www/html
 
-    # CORS headers matching prior Nginx behavior
+    # CORS (reflect allowed origins; credentials-compatible)
+    # Allow only truckwash.dk subdomains and localhost for dev
+    @cors_origin header_regexp Origin ^https?://([a-z0-9-]+\.)?truckwash\.dk(:\d+)?$|^https?://localhost(:\d+)?$
     @options method OPTIONS
-    header {
+
+    header @cors_origin {
+        # Ensure no duplicate CORS headers from upstream app
+        -Access-Control-Allow-Origin
+        -Access-Control-Allow-Credentials
+        -Access-Control-Allow-Methods
+        -Access-Control-Allow-Headers
+        -Access-Control-Max-Age
+        Access-Control-Allow-Origin "{http.request.header.Origin}"
         Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
         Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number"
         Access-Control-Allow-Credentials true
-        Access-Control-Allow-Origin "*"
+        Access-Control-Max-Age 86400
+        Vary Origin
     }
+
+    # Preflight fast-path
     respond @options 204
 
     # PHP handling via FastCGI to php-fpm pool