diff --git a/cmd/server/main.go b/cmd/server/main.go
index b2968ca..9ad8ab9 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -163,7 +163,10 @@ func main() {
 		r.Group(func(r chi.Router) {
 			r.Use(middleware.Session(sessionStore, cfg))
 			r.Use(middleware.RequireAuth)
-			r.Use(middleware.CSRFProtect(cfg.Host, cfg.Port, strings.Split(os.Getenv("DUMPSTER_CSRF_ORIGINS"), ",")))
+			r.Use(middleware.CSRFProtect(cfg.Host, cfg.Port, append(
+				strings.Split(os.Getenv("DUMPSTER_CSRF_ORIGINS"), ","),
+				"tauri://localhost", "http://tauri.localhost", "https://tauri.localhost",
+			)))
 
 			// Auth (protected: me, update profile)
 			authHandler.RegisterProtectedRoutes(r)