diff --git a/docker/compose.yaml b/docker/compose.yaml
index 1c40cd0..1db62d1 100644
--- a/docker/compose.yaml
+++ b/docker/compose.yaml
@@ -106,13 +106,9 @@ services:
       MERCURE_CORS_ALLOWED_ORIGINS: ${MERCURE_CORS_ALLOWED_ORIGINS}
       MERCURE_PUBLISH_ALLOWED_ORIGINS: ${MERCURE_CORS_ALLOWED_ORIGINS}
       MERCURE_EXTRA_DIRECTIVES: |
-        cors_origins "*"
-        publish_origins "*"
+        cors_origins ${MERCURE_CORS_ALLOWED_ORIGINS}
+        publish_origins ${MERCURE_CORS_ALLOWED_ORIGINS}
         anonymous
-        # Add explicit CORS headers for safety
-        header Access-Control-Allow-Origin "*"
-        header Access-Control-Allow-Methods "GET, POST, OPTIONS"
-        header Access-Control-Allow-Headers "Authorization, Content-Type"
     ports:
       - "8090:80"
     volumes: