diff --git a/genkit-tools/common/src/server/server.ts b/genkit-tools/common/src/server/server.ts
index de20bd41e8..0fe5e33fa9 100644
--- a/genkit-tools/common/src/server/server.ts
+++ b/genkit-tools/common/src/server/server.ts
@@ -90,10 +90,9 @@ export function startServer(manager: BaseRuntimeManager, port: number) {
   let server: Server;
   const app = express();
 
-  // Allow all origins and expose trace ID header
   app.use(
     cors({
-      origin: '*',
+      origin: /^http:\/\/localhost:\d+$/,
       allowedHeaders: ['Content-Type'],
       exposedHeaders: ['X-Genkit-Trace-Id'],
     })