diff --git a/docker-compose.yml b/docker-compose.yml
index f4769d2..ea01b84 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,6 +21,9 @@ services:
             - RUST_BACKTRACE=1
             - IRMA_SERVER=http://irma-server:8088
             - DATABASE_URL=postgres://devuser:devpassword@postgres:5432/devdb
+            # allowed-origins is required (no default); dev explicitly opts into
+            # the wildcard so local cross-origin requests work.
+            - PKG_ALLOWED_ORIGINS=*
         networks:
             - pg-network
         depends_on:
diff --git a/entrypoint.sh b/entrypoint.sh
index b2ea970..d7ec69a 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -24,6 +24,7 @@ fi
 exec /usr/local/bin/pg-pkg server \
     ${IRMA_TOKEN:+-t "$IRMA_TOKEN"} \
     -i "${IRMA_SERVER:-https://is.yivi.app}" \
+    ${PKG_ALLOWED_ORIGINS:+--allowed-origins "$PKG_ALLOWED_ORIGINS"} \
     --ibe-secret-path "$KEYS_DIR/pkg_ibe.sec" \
     --ibe-public-path "$KEYS_DIR/pkg_ibe.pub" \
     --ibs-secret-path "$KEYS_DIR/pkg_ibs.sec" \
diff --git a/pg-pkg/src/opts.rs b/pg-pkg/src/opts.rs
index 238b049..80d95c7 100644
--- a/pg-pkg/src/opts.rs
+++ b/pg-pkg/src/opts.rs
@@ -85,14 +85,16 @@ pub struct ServerOpts {
     pub ibs_public_path: String,
 
     /// Comma-separated list of origins allowed to make cross-origin requests
-    /// to the PKG. The special value `*` allows any origin (the historical
-    /// default), but is discouraged for production deployments that handle
-    /// key material. Example:
+    /// to the PKG. This option is required and has no default: the server
+    /// refuses to start unless an allowlist is supplied, so CORS is never
+    /// silently open to all origins in production. The special value `*`
+    /// allows any origin, but must be opted into explicitly and is discouraged
+    /// for deployments that handle key material. Example:
     /// `--allowed-origins https://postguard.eu,https://postguard.nl`.
     #[clap(
         long,
         env = "PKG_ALLOWED_ORIGINS",
-        default_value = "*",
+        required = true,
         value_delimiter = ','
     )]
     pub allowed_origins: Vec<String>,