diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
index d8f7462..33255f1 100644
--- a/apps/web/vite.config.ts
+++ b/apps/web/vite.config.ts
@@ -272,35 +272,49 @@ export default defineConfig(({ mode }) => {
         configureServer: (server) => attachNovncProxy(server, screenProxySecret(), api),
         configurePreviewServer: (server) => attachNovncProxy(server, screenProxySecret(), api),
       },
+      {
+        // Replace Vite's built-in CORS with origin-echoing CORS for credentials support
+        name: "rakazo-cors",
+        configureServer: (server) => {
+          // Vite's cors middleware runs before our middleware.
+          // We handle CORS ourselves and let Vite's cors be a no-op.
+          // Since cors: false disables Vite's CORS, we handle everything here.
+          server.middlewares.use((req, res, next) => {
+            const origin = req.headers.origin;
+            if (origin && typeof origin === "string") {
+              res.setHeader("access-control-allow-origin", origin);
+              res.setHeader("access-control-allow-credentials", "true");
+              res.setHeader("access-control-allow-methods", "GET, HEAD, PUT, PATCH, POST, DELETE, OPTIONS");
+              res.setHeader("access-control-allow-headers", "content-type, x-rakazo-space-id, authorization");
+              res.setHeader("access-control-max-age", "86400");
+              if (req.method === "OPTIONS") {
+                res.writeHead(204);
+                res.end();
+                return;
+              }
+            }
+            next();
+          });
+        },
+      },
     ],
     server: {
       host: "0.0.0.0",
       port: webPort,
       strictPort: true,
       allowedHosts: true,
+      // Disable Vite built-in CORS — our middleware handles it
+      cors: false,
       proxy: {
-        "/api": {
-          target: api,
-          changeOrigin: true,
-          configure: (proxy) => {
-            proxy.on("proxyRes", (res) => {
-              res.headers["access-control-allow-origin"] = "*";
-              res.headers["access-control-allow-credentials"] = "true";
-            });
-          },
-        },
         "/rpc": {
           target: api,
-          changeOrigin: true,
-          configure: (proxy) => {
-            proxy.on("proxyRes", (res) => {
-              res.headers["access-control-allow-origin"] = "*";
-              res.headers["access-control-allow-credentials"] = "true";
-            });
-          },
+          changeOrigin: false,
+        },
+        "/api": {
+          target: api,
+          changeOrigin: false,
         },
       },
-      cors: true,
     },
     preview: {
       host: "0.0.0.0",