diff --git a/apps/portal-bff/.env.example b/apps/portal-bff/.env.example
index 4ee0412..aa67ea3 100644
--- a/apps/portal-bff/.env.example
+++ b/apps/portal-bff/.env.example
@@ -133,9 +133,10 @@ LOG_USER_ID_SALT=replace_with_32_random_bytes_base64url
 # defaulting to localhost is the classic "works in dev, breaks in
 # prod" trap.
 #
-# Local dev: the portal-shell dev server on :4200. Add :4201 once
-# portal-admin grows its own dev server.
-CORS_ALLOWED_ORIGINS=http://localhost:4200
+# Local dev: portal-shell on :4200 and portal-admin on :4300 — both
+# call the BFF with credentials. Source of truth for the ports:
+# `apps/<app>/project.json` `serve.options.port`.
+CORS_ALLOWED_ORIGINS=http://localhost:4200,http://localhost:4300
 
 # Rate limiting (per ADR-0015 §"DoS mitigation"). Both optional
 # with conservative defaults; override per environment when traffic