diff --git a/Dockerfile b/Dockerfile
index a575102..469c595 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,5 +21,8 @@ ENTRYPOINT ["/app/code/start.sh"]
 
 # LiteLLM v1.74.0 hardcodes `origins = ["*"]` (with allow_credentials=True) in
 # proxy_server.py and ignores LITELLM_CORS_ALLOWED_ORIGINS entirely. Rewrite it
-# to honour the env var so we can lock CORS to the chat origin.
-RUN sed -i 's/^origins = \["\*"\]$/import os; origins = os.getenv("LITELLM_CORS_ALLOWED_ORIGINS", "*").split(",")/' /app/litellm/proxy/proxy_server.py
+# to honour the env var so we can lock CORS to the chat origin. Patch every copy
+# (site-packages is what the running CLI imports; /app/litellm is a dev copy).
+RUN sed -i 's/^origins = \["\*"\]$/import os; origins = os.getenv("LITELLM_CORS_ALLOWED_ORIGINS", "*").split(",")/' \
+      /usr/lib/python3.13/site-packages/litellm/proxy/proxy_server.py \
+      /app/litellm/proxy/proxy_server.py