diff --git a/services/ml/app/main.py b/services/ml/app/main.py
index d93955f..c3ffea8 100644
--- a/services/ml/app/main.py
+++ b/services/ml/app/main.py
@@ -5,6 +5,7 @@ Provides REST API endpoints for model serving, health checks, and prediction.
 """
 
 import logging
+import os
 import re
 import threading
 import uuid as uuid_lib
@@ -48,10 +49,14 @@ app = FastAPI(
     version="1.0.0"
 )
 
+# Parse CORS origins from environment variable or use default
+cors_origins_str = os.getenv("CORS_ORIGINS", "http://localhost:3000")
+allow_origins = [origin.strip() for origin in cors_origins_str.split(",")]
+
 # CORS middleware
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],  # In production, specify actual origins
+    allow_origins=allow_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],