diff --git a/config/cors.php b/config/cors.php
index fb1bf26..19f2551 100644
--- a/config/cors.php
+++ b/config/cors.php
@@ -15,11 +15,14 @@ return [
     |
     */
 
-    'paths' => ['api/*', 'sanctum/csrf-cookie', 'broadcasting/auth'],
+
+    'paths' => explode(',', env('CORS_PATHS', 'api/*')),
 
     'allowed_methods' => ['*'],
 
-    'allowed_origins' => env('DEV', 0) == 1 ? ['http://localhost:5173'] : ['http://localhost'],
+    'allowed_origins' => env('DEV', 0) == 1
+        ? explode(',', env('DEV_CORS_ALLOWED_ORIGINS'))
+        : explode(',', env('PROD_CORS_ALLOWED_ORIGINS')),
 
     'allowed_origins_patterns' => [],