diff --git a/cloudflared-config.yml b/cloudflared-config.yml
index 593d08729..26183f87b 100644
--- a/cloudflared-config.yml
+++ b/cloudflared-config.yml
@@ -251,6 +251,11 @@ ingress:
   - hostname: nutriphi-api.mana.how
     service: http://localhost:3086
 
+  # manawald — Skizzenbuch + Mini-App-Inkubator (Code/manawald, separate repo).
+  # Port 3090 per mana/docs/PORTS.md. Alpha-only, kein public.
+  - hostname: manawald.mana.how
+    service: http://localhost:3090
+
   # ============================================
   # Standalone web apps (separate containers)
   # ============================================
diff --git a/docker-compose.macmini.yml b/docker-compose.macmini.yml
index c5cc421ec..c54d712fd 100644
--- a/docker-compose.macmini.yml
+++ b/docker-compose.macmini.yml
@@ -250,7 +250,7 @@ services:
       # Enforced by services/mana-auth/src/auth/sso-config.spec.ts.
       # All productivity modules now live under mana.how (path-based) —
       # no per-module subdomain entries required here.
-      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://memoro-app.mana.how,https://zitare.mana.how,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how
+      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://memoro-app.mana.how,https://zitare.mana.how,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how,https://manawald.mana.how
     ports:
       - "3001:3001"
     healthcheck: