diff --git a/docker-compose.macmini.yml b/docker-compose.macmini.yml
index 7406c346b..49164f7d6 100644
--- a/docker-compose.macmini.yml
+++ b/docker-compose.macmini.yml
@@ -250,7 +250,7 @@ services:
       # Enforced by services/mana-auth/src/auth/sso-config.spec.ts.
       # All productivity modules now live under mana.how (path-based) —
       # no per-module subdomain entries required here.
-      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cards.mana.how,https://cards-api.mana.how
+      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cards.mana.how,https://cards-api.mana.how,https://memoro-app.mana.how
     ports:
       - "3001:3001"
     healthcheck:
diff --git a/services/mana-auth/src/auth/sso-origins.ts b/services/mana-auth/src/auth/sso-origins.ts
index adf5c88d7..b732c92f9 100644
--- a/services/mana-auth/src/auth/sso-origins.ts
+++ b/services/mana-auth/src/auth/sso-origins.ts
@@ -27,6 +27,7 @@ export const PRODUCTION_TRUSTED_ORIGINS = [
 	'https://whopxl.mana.how', // Games
 	'https://cards.mana.how', // Cards spaced-repetition spinoff (own SvelteKit container, not the unified app)
 	'https://cards-api.mana.how', // Cards marketplace + community backend (cards-server)
+	'https://memoro-app.mana.how', // Memoro web SPA (separate deploy under mana e.V.)
 ] as const;
 
 /** Local dev origins — web dev server + the auth server itself. */