diff --git a/Dockerfile b/Dockerfile
index fa9be54..a575102 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,3 +18,8 @@ COPY config.yaml /app/data/config.yaml
 # Override the base image's ENTRYPOINT (which is `litellm`) so our
 # startup script runs instead of being passed as an argument to litellm.
 ENTRYPOINT ["/app/code/start.sh"]
+
+# LiteLLM v1.74.0 hardcodes `origins = ["*"]` (with allow_credentials=True) in
+# proxy_server.py and ignores LITELLM_CORS_ALLOWED_ORIGINS entirely. Rewrite it
+# to honour the env var so we can lock CORS to the chat origin.
+RUN sed -i 's/^origins = \["\*"\]$/import os; origins = os.getenv("LITELLM_CORS_ALLOWED_ORIGINS", "*").split(",")/' /app/litellm/proxy/proxy_server.py