diff --git a/backend/qualibrate_app/app.py b/backend/qualibrate_app/app.py
index bc72a2b4..c6374ea4 100644
--- a/backend/qualibrate_app/app.py
+++ b/backend/qualibrate_app/app.py
@@ -9,6 +9,7 @@
 )
 from qualibrate_app.config.resolvers import (
     get_config_path,
+    get_cors_origin,
     get_default_static_files_path,
     get_settings,
 )
@@ -25,18 +26,12 @@
     docs_url="/app_docs",
 )
 _settings = get_settings(get_config_path())
-
-origins = [
-    "http://localhost:8002",
-    "http://localhost:8001",
-    "http://127.0.0.1:8002",
-    "http://127.0.0.1:8001",
-]
+cors_origins = get_cors_origin()
 
 app.add_middleware(QualibrateCatchExcMiddleware)
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origins=cors_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
diff --git a/backend/qualibrate_app/cli/start.py b/backend/qualibrate_app/cli/start.py
index 9a6ba12d..ed0e31ec 100644
--- a/backend/qualibrate_app/cli/start.py
+++ b/backend/qualibrate_app/cli/start.py
@@ -8,6 +8,7 @@
 )
 
 from qualibrate_app.config import CONFIG_PATH_ENV_NAME
+from qualibrate_app.config.vars import CORS_ORIGINS_ENV_NAME
 
 
 @click.command(name="start")
@@ -33,8 +34,21 @@
     show_default=True,
     help="Application will be started on the given port",
 )  # env QUALIBRATE_START_PORT
-def start_command(config_path: Path, port: int, reload: bool) -> None:
+@click.option(
+    "--cors-origin",
+    type=str,
+    multiple=True,
+    help="CORS origin to use. Can be passed multiple times.",
+)
+def start_command(
+    config_path: Path,
+    port: int,
+    reload: bool,
+    cors_origin: list[str],
+) -> None:
     os.environ[CONFIG_PATH_ENV_NAME] = str(config_path)
+    if len(cors_origin) != 0:
+        os.environ[CORS_ORIGINS_ENV_NAME] = ",".join(cors_origin)
 
     from qualibrate_app.app import main as app_main
 
diff --git a/backend/qualibrate_app/config/resolvers.py b/backend/qualibrate_app/config/resolvers.py
index e06e4bae..34f822c3 100644
--- a/backend/qualibrate_app/config/resolvers.py
+++ b/backend/qualibrate_app/config/resolvers.py
@@ -1,6 +1,7 @@
 import os
 import warnings
 from functools import lru_cache
+from itertools import product
 from pathlib import Path
 from typing import Annotated, Optional
 
@@ -15,11 +16,13 @@
 
 from qualibrate_app.config.vars import (
     CONFIG_PATH_ENV_NAME,
+    CORS_ORIGINS_ENV_NAME,
 )
 
 __all__ = [
     "get_default_static_files_path",
     "get_config_path",
+    "get_cors_origin",
     "get_settings",
     "get_quam_state_path",
 ]
@@ -43,6 +46,19 @@ def get_config_path() -> Path:
     return get_qualibrate_config_path()
 
 
+@lru_cache
+def get_cors_origin() -> list[str]:
+    cors_env = os.environ.get(CORS_ORIGINS_ENV_NAME)
+    if cors_env is not None:
+        return list(cors_env.split(","))
+    return list(
+        f"http://{host}:{port}"
+        for host, port in product(
+            ["localhost", "127.0.0.1"], [1234, 8000, 8001]
+        )
+    )
+
+
 @lru_cache
 def get_settings(
     config_path: Annotated[Path, Depends(get_config_path)],
diff --git a/backend/qualibrate_app/config/vars.py b/backend/qualibrate_app/config/vars.py
index a7d3f718..958f039b 100644
--- a/backend/qualibrate_app/config/vars.py
+++ b/backend/qualibrate_app/config/vars.py
@@ -1,3 +1,4 @@
 CONFIG_PATH_ENV_NAME = "QUALIBRATE_APP_CONFIG_FILE"
+CORS_ORIGINS_ENV_NAME = "QUALIBRATE_APP_CORS_ORIGINS"
 
 METADATA_OUT_PATH = "data_path"