diff --git a/mcp-stack.compose.yml b/mcp-stack.compose.yml
index 3f99878..1847e36 100644
--- a/mcp-stack.compose.yml
+++ b/mcp-stack.compose.yml
@@ -130,7 +130,10 @@ services:
       context: ./browser-mcp
     environment:
       BROWSER_MCP_API_KEYS: ${BROWSER_MCP_API_KEYS}
-      BROWSER_MCP_ALLOWED_ORIGINS: ${BROWSER_MCP_ALLOWED_ORIGINS:-http://dev-server-worker:5173}
+      # Both: the shared service's fixed port, and the range the per-execution ones are given.
+      # Keep the range aligned with DEV_SERVER_PORT_RANGE or a preview starts on a port the
+      # browser is not allowed to open - which reads as a broken app, not as a refused origin.
+      BROWSER_MCP_ALLOWED_ORIGINS: ${BROWSER_MCP_ALLOWED_ORIGINS:-http://dev-server-worker:5173,http://dev-server-worker:5200-5219}
       BROWSER_MCP_MAX_SESSIONS: ${BROWSER_MCP_MAX_SESSIONS:-8}
     user: "1000:1000"
     read_only: true
diff --git a/mcp-stack.env.example b/mcp-stack.env.example
index 40cdcf5..ab309b5 100644
--- a/mcp-stack.env.example
+++ b/mcp-stack.env.example
@@ -23,7 +23,7 @@ DEV_SERVER_MAX_INSTANCES=4
 
 # Every port an execution can be given has to be reachable by the browser, and the allowlist is by
 # exact origin - so the range is spelled out here. Keep it aligned with DEV_SERVER_PORT_RANGE.
-BROWSER_MCP_ALLOWED_ORIGINS=http://dev-server-worker:5200-5219
+BROWSER_MCP_ALLOWED_ORIGINS=http://dev-server-worker:5173,http://dev-server-worker:5200-5219
 
 CODING_AGENT_MCP_PORT=3101
 DEV_SERVER_MCP_PORT=3102