diff --git a/cmd/server/main.go b/cmd/server/main.go
index 0d61ab5..70b253d 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"net/http"
 	"os"
+	"strings"
 
 	_ "git.dustin.coffee/hobokenchicken/dumpsterChat/docs"
 	"git.dustin.coffee/hobokenchicken/dumpsterChat/internal/auth"
@@ -126,7 +127,7 @@ func main() {
 		r.Group(func(r chi.Router) {
 			r.Use(middleware.Session(sessionStore, cfg))
 			r.Use(middleware.RequireAuth)
-			r.Use(middleware.CSRFProtect(cfg.Host, cfg.Port, nil))
+			r.Use(middleware.CSRFProtect(cfg.Host, cfg.Port, strings.Split(os.Getenv("DUMPSTER_CSRF_ORIGINS"), ",")))
 
 			// Auth (protected: me, update profile)
 			authHandler.RegisterProtectedRoutes(r)