diff --git a/packages/server/src/server/websocket-server.ts b/packages/server/src/server/websocket-server.ts
index 7c719b454..2a90a7464 100644
--- a/packages/server/src/server/websocket-server.ts
+++ b/packages/server/src/server/websocket-server.ts
@@ -396,7 +396,7 @@ export class VoiceAssistantWebSocketServer {
           !!requestHost &&
           (origin === `http://${requestHost}` || origin === `https://${requestHost}`);
 
-        if (!origin || allowedOrigins.has(origin) || sameOrigin) {
+        if (!origin || allowedOrigins.has("*") || allowedOrigins.has(origin) || sameOrigin) {
           callback(true);
         } else {
           this.incrementRuntimeCounter("originRejected");
diff --git a/scripts/dev.sh b/scripts/dev.sh
index 3ddc9104e..86b7d9edf 100755
--- a/scripts/dev.sh
+++ b/scripts/dev.sh
@@ -39,7 +39,10 @@ echo "════════════════════════
 # through the daemon's Portless URL instead of a fixed localhost port.
 APP_ORIGIN="$(portless get app)"
 DAEMON_ENDPOINT="$(portless get daemon | sed -E 's#^https?://##')"
-export PASEO_CORS_ORIGINS="${APP_ORIGIN}"
+# Allow any origin in dev so Electron on random ports and Portless URLs all work.
+# SECURITY: wildcard CORS is unsafe in production — only acceptable here because
+# the daemon binds to localhost and this script is never used for production.
+export PASEO_CORS_ORIGINS="*"
 
 # Run both with concurrently
 # BROWSER=none prevents auto-opening browser