diff --git a/server/index.ts b/server/index.ts
index cd10641..2011e3e 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -13,7 +13,16 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const app = express()
 const PORT = parseInt(process.env.PORT ?? '3001')
 
-app.use(cors({ origin: ['http://localhost:5173', 'http://localhost:4173', 'http://localhost:3000'] }))
+app.use(cors({
+  origin: [
+    'http://localhost:5173',
+    'http://localhost:4173',
+    'http://localhost:3000',
+    'https://gitstats.hivarsoft.com',
+    // also allow any *.vercel.app preview deployments
+    /\.vercel\.app$/,
+  ],
+}))
 app.use(express.json({ limit: '1mb' }))
 
 // ─── Health check ─────────────────────────────────────────────────────────────
diff --git a/src/api/client.ts b/src/api/client.ts
index c884b60..970f757 100644
--- a/src/api/client.ts
+++ b/src/api/client.ts
@@ -1,6 +1,8 @@
 import type { GitStatsReport } from '@/types'
 
-const BASE = '/api'
+// In dev, Vite proxies /api → localhost:3001.
+// In production (Vercel), VITE_API_URL is set to the Railway backend URL.
+const BASE = (import.meta.env.VITE_API_URL ?? '').replace(/\/$/, '') + '/api'
 
 export interface AnalyzeResponse {
   report: GitStatsReport
diff --git a/vercel.json b/vercel.json
new file mode 100644
index 0000000..1323cda
--- /dev/null
+++ b/vercel.json
@@ -0,0 +1,8 @@
+{
+  "rewrites": [
+    {
+      "source": "/(.*)",
+      "destination": "/index.html"
+    }
+  ]
+}