diff --git a/.env.production b/.env.production
index 1362baa..0010331 100644
--- a/.env.production
+++ b/.env.production
@@ -19,8 +19,15 @@ PORTS=3000,8000
 
 # --- CORS ------------------------------------------------------------------
 # The FRONTEND's origin, not this API's. Wrong value = the browser blocks every
-# response while the server logs healthy 200s.
-API_CORS_ORIGINS=https://catalogue.nearle.ai.in
+# response while the server logs healthy 200s - which is exactly what happened
+# here: this was set to catalogue.nearle.ai.in, but the domain Traefik actually
+# serves is spelled "catalouge". That host does not even resolve, so nothing
+# pointed at the mistake except a silently failing UI.
+#
+# Both spellings are listed so this keeps working if the typo is ever corrected
+# in Dokploy. Exact origins, never a wildcard: the app sends an Authorization
+# header, and browsers reject credentialed requests to a wildcard origin.
+API_CORS_ORIGINS=https://catalouge.nearle.ai.in,https://catalogue.nearle.ai.in
 
 # --- Authentication --------------------------------------------------------
 AUTH_ENABLED=true