diff --git a/.devcontainer/entrypoint.sh b/.devcontainer/entrypoint.sh
index 6c600af2..d64a5623 100644
--- a/.devcontainer/entrypoint.sh
+++ b/.devcontainer/entrypoint.sh
@@ -71,7 +71,7 @@ ADMIN_URL = 'admin/'
 
 ALLOWED_HOSTS = ['${API_HOST}', '${APP_HOST}', '*']
 
-CORS_ORIGIN_WHITELIST = ['https://${API_HOST}', 'https://${APP_HOST}']
+CORS_ORIGIN_WHITELIST = ['https://${APP_HOST}', 'https://${API_HOST}']
 CORS_ALLOW_CREDENTIALS = True
 
 SESSION_COOKIE_DOMAIN = '${BASE_DOMAIN}'
diff --git a/docker/containers/tactical/entrypoint.sh b/docker/containers/tactical/entrypoint.sh
index 7f73a461..09927c6d 100644
--- a/docker/containers/tactical/entrypoint.sh
+++ b/docker/containers/tactical/entrypoint.sh
@@ -92,7 +92,7 @@ ALLOWED_HOSTS = ['${API_HOST}', '${APP_HOST}', 'tactical-backend']
 
 ADMIN_URL = '${ADMINURL}/'
 
-CORS_ORIGIN_WHITELIST = ['https://${API_HOST}', 'https://${APP_HOST}']
+CORS_ORIGIN_WHITELIST = ['https://${APP_HOST}', 'https://${API_HOST}']
 CORS_ALLOW_CREDENTIALS = True
 
 SESSION_COOKIE_DOMAIN = '${BASE_DOMAIN}'