diff --git a/apps/api/main.py b/apps/api/main.py
index 64a2bcf7c..070049983 100644
--- a/apps/api/main.py
+++ b/apps/api/main.py
@@ -38,10 +38,11 @@ if settings.DEBUG:
     allow_origins = settings.CORS_ORIGINS  # Allow localhost in debug mode
 else:
     # In production, filter out any wildcard "*" origins
-    allow_origins = [origin for origin in settings.CORS_ORIGINS if origin != "*"]
-    if not allow_origins:
-        # Default to production domains if no valid origins configured
-        allow_origins = ["https://xiaoxiajianji.com", "https://saas.xiaoxiajianji.com"]
+    allow_origins = list({origin for origin in settings.CORS_ORIGINS if origin != "*"})
+    # Always ensure production domains are included
+    for domain in ("https://xiaoxiajianji.com", "https://saas.xiaoxiajianji.com"):
+        if domain not in allow_origins:
+            allow_origins.append(domain)
 
 app.add_middleware(
     CORSMiddleware,