diff --git a/README.md b/README.md
index 244670c..468abe5 100644
--- a/README.md
+++ b/README.md
@@ -221,7 +221,7 @@ GOOGLE_OAUTH_CLIENT_SECRET=
 
 Then set the two that decide who gets in and from where:
 
-- `TRUSTED_ORIGINS` — where the app is served from, `http://localhost:3010` locally. It defaults to `http://localhost:3000`, which is not where `start.sh` serves the app.
+- `TRUSTED_ORIGINS` — where the app is served from. Unset, that is `http://localhost:3010`, which is where `start.sh` serves the app.
 - `INITIAL_ADMIN_EMAILS` — comma separated. An address listed here becomes an administrator the first time it signs in; everybody else becomes a user.
 
 Remove `OPENBOT_DEV_NO_AUTH`, then restart: the sign-in button is written into the app's generated config at startup, so it appears only once all four settings are present. Accounts, sessions and roles are stored in the same PostgreSQL database as everything else.
diff --git a/docs/configuration.md b/docs/configuration.md
index 0657fb2..6d30256 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -86,7 +86,7 @@ Two things are worth knowing before pointing a deployment at any gateway. Not ev
 | `GOOGLE_OAUTH_CLIENT_SECRET` | Google OAuth client secret.                                                            |
 | `BETTER_AUTH_SECRET`         | At least 32 characters. Required with Google OAuth.                                    |
 | `BETTER_AUTH_URL`            | Public API server base URL. Required with Google OAuth.                                |
-| `TRUSTED_ORIGINS`            | Comma-separated app origins accepted by the API.                                       |
+| `TRUSTED_ORIGINS`            | Comma-separated app origins accepted by the API. Unset, `http://localhost:3010`.       |
 | `INITIAL_ADMIN_EMAILS`       | Comma-separated users seeded as administrators.                                        |
 
 Google OAuth client id and secret must be configured together. If Google OAuth is configured, `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL` are also required.
diff --git a/server/src/config.ts b/server/src/config.ts
index 9e9c2c8..504722f 100644
--- a/server/src/config.ts
+++ b/server/src/config.ts
@@ -218,9 +218,11 @@ function authConfig(
     baseUrl,
     secret,
     google,
+    // start.sh serves the app on 3010. A clone that enables Google sign-in without
+    // setting TRUSTED_ORIGINS must still accept the origin the app actually answers on.
     trustedOrigins: commaSeparated(environment, "TRUSTED_ORIGINS").length
       ? commaSeparated(environment, "TRUSTED_ORIGINS")
-      : ["http://localhost:3000"],
+      : ["http://localhost:3010"],
     initialAdminEmails: commaSeparated(environment, "INITIAL_ADMIN_EMAILS"),
   };
 }
diff --git a/server/tests/config.test.ts b/server/tests/config.test.ts
index 326ad5c..efbe379 100644
--- a/server/tests/config.test.ts
+++ b/server/tests/config.test.ts
@@ -137,7 +137,7 @@ describe("deployment configuration", () => {
         clientId: "google-client-id",
         clientSecret: "google-client-secret",
       },
-      trustedOrigins: ["http://localhost:3000"],
+      trustedOrigins: ["http://localhost:3010"],
       initialAdminEmails: ["admin@openbot.test", "owner@openbot.test"],
     });
   });