diff --git a/backend/api.py b/backend/api.py
index 4fb4070a..e15a377f 100644
--- a/backend/api.py
+++ b/backend/api.py
@@ -106,15 +106,17 @@ async def log_requests_middleware(request: Request, call_next):
 
 # Define allowed origins based on environment
 allowed_origins = ["https://www.suna.so", "https://suna.so", "http://localhost:3000"]
+allow_origin_regex = None
 
 # Add staging-specific origins
 if config.ENV_MODE == EnvMode.STAGING:
-    allowed_origins.append("https://suna-*-prjcts.vercel.app")
     allowed_origins.append("https://staging.suna.so")
+    allow_origin_regex = r"https://suna-.*-prjcts\.vercel\.app"
 
 app.add_middleware(
     CORSMiddleware,
     allow_origins=allowed_origins,
+    allow_origin_regex=allow_origin_regex,
     allow_credentials=True,
     allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
     allow_headers=["Content-Type", "Authorization"],
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 1ce7d844..8078f586 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -36,8 +36,9 @@ services:
       - "8000:8000"
     volumes:
       - ./backend/.env:/app/.env:ro
+    env_file:
+      - ./backend/.env
     environment:
-      - ENV_MODE=local
       - REDIS_HOST=redis
       - REDIS_PORT=6379
       - REDIS_PASSWORD=
@@ -59,8 +60,9 @@ services:
     command: python -m dramatiq run_agent_background
     volumes:
       - ./backend/.env:/app/.env:ro
+    env_file:
+      - ./backend/.env
     environment:
-      - ENV_MODE=local
       - REDIS_HOST=redis
       - REDIS_PORT=6379
       - REDIS_PASSWORD=