diff --git a/apps/api/src/cors-origins.test.mjs b/apps/api/src/cors-origins.test.mjs
new file mode 100644
index 00000000..da93d49b
--- /dev/null
+++ b/apps/api/src/cors-origins.test.mjs
@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test";
+import { DESKTOP_APP_ORIGIN } from "../../desktop/src/main/app-protocol.mjs";
+import { fetchEdgeEverApp } from "./index";
+
+const executionContext = {
+  passThroughOnException() {},
+  waitUntil() {},
+};
+
+const corsRequest = (origin, { method = "GET", path = "/api/release" } = {}) => {
+  const headers = { Origin: origin };
+  if (method === "OPTIONS") {
+    headers["Access-Control-Request-Method"] = "GET";
+    headers["Access-Control-Request-Headers"] = "authorization,content-type";
+  }
+  return fetchEdgeEverApp(
+    new Request(`https://notes.example.com${path}`, { method, headers }),
+    {},
+    executionContext,
+  );
+};
+
+describe("API CORS origins", () => {
+  test("allows the packaged desktop renderer origin on credentialed API requests", async () => {
+    const response = await corsRequest(DESKTOP_APP_ORIGIN);
+
+    expect(DESKTOP_APP_ORIGIN).toBe("edgeever-app://app");
+    expect(response.status).toBe(200);
+    expect(response.headers.get("access-control-allow-origin")).toBe(DESKTOP_APP_ORIGIN);
+    expect(response.headers.get("access-control-allow-credentials")).toBe("true");
+  });
+
+  test("answers a desktop preflight without omitting Access-Control-Allow-Origin", async () => {
+    const response = await corsRequest(DESKTOP_APP_ORIGIN, { method: "OPTIONS", path: "/api/v1/auth/session" });
+
+    expect(response.status).toBe(204);
+    expect(response.headers.get("access-control-allow-origin")).toBe(DESKTOP_APP_ORIGIN);
+    expect(response.headers.get("access-control-allow-headers")).toContain("Authorization");
+    expect(response.headers.get("access-control-allow-methods")).toContain("GET");
+  });
+
+  test("keeps local Vite and legacy file renderer origins working", async () => {
+    for (const origin of ["http://127.0.0.1:5173", "http://localhost:5173", "null"]) {
+      const response = await corsRequest(origin);
+      expect(response.status).toBe(200);
+      expect(response.headers.get("access-control-allow-origin")).toBe(origin);
+    }
+  });
+
+  test("does not reflect arbitrary website origins", async () => {
+    const response = await corsRequest("https://evil.example");
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("access-control-allow-origin")).toBeNull();
+  });
+});
diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index b3a33fab..5c86d4b0 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -148,10 +148,18 @@ const DEMO_RESET_COOLDOWN_MS = 60 * 1000;
 const DEFAULT_R2_BUCKET_NAME = "edgeever-resources";
 const app = new Hono<AppEnv>();
 
+// Packaged desktop uses edgeever-app://app; the previous file:// renderer sent Origin "null".
+const API_CORS_ORIGINS = [
+  "http://127.0.0.1:5173",
+  "http://localhost:5173",
+  "null",
+  "edgeever-app://app",
+];
+
 app.use(
   "/api/*",
   cors({
-    origin: ["http://127.0.0.1:5173", "http://localhost:5173", "null"],
+    origin: API_CORS_ORIGINS,
     allowHeaders: ["Content-Type", "Authorization"],
     allowMethods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
     credentials: true,
@@ -161,7 +169,7 @@ app.use(
 app.use(
   "/mcp",
   cors({
-    origin: ["http://127.0.0.1:5173", "http://localhost:5173", "null"],
+    origin: API_CORS_ORIGINS,
     allowHeaders: ["Content-Type", "Authorization"],
     allowMethods: ["GET", "POST", "OPTIONS"],
     credentials: true,
diff --git a/apps/desktop/src/main/app-protocol.mjs b/apps/desktop/src/main/app-protocol.mjs
index 1cd136f2..40a404a2 100644
--- a/apps/desktop/src/main/app-protocol.mjs
+++ b/apps/desktop/src/main/app-protocol.mjs
@@ -5,6 +5,7 @@ import { Readable } from "node:stream";
 
 export const DESKTOP_APP_SCHEME = "edgeever-app";
 export const DESKTOP_APP_HOST = "app";
+// Instance API CORS must allow this origin; omitting it makes packaged login look like a network failure.
 export const DESKTOP_APP_ORIGIN = `${DESKTOP_APP_SCHEME}://${DESKTOP_APP_HOST}`;
 export const DESKTOP_APP_ENTRY_URL = `${DESKTOP_APP_ORIGIN}/index.html`;