diff --git a/packages/desktop/src/daemon/daemon-manager.ts b/packages/desktop/src/daemon/daemon-manager.ts
index d678662c8..57e1f79ad 100644
--- a/packages/desktop/src/daemon/daemon-manager.ts
+++ b/packages/desktop/src/daemon/daemon-manager.ts
@@ -148,8 +148,6 @@ function buildDesktopDaemonCorsOriginsEnv(): string | undefined {
       .filter((value) => value.length > 0),
   );
 
-  origins.add("paseo://app");
-
   const devServerUrl = process.env.EXPO_DEV_URL ?? DEFAULT_ELECTRON_DEV_SERVER_URL;
   try {
     const parsed = new URL(devServerUrl);
diff --git a/packages/server/src/server/bootstrap.ts b/packages/server/src/server/bootstrap.ts
index b00bde3cb..06f45ca61 100644
--- a/packages/server/src/server/bootstrap.ts
+++ b/packages/server/src/server/bootstrap.ts
@@ -249,9 +249,8 @@ export async function createPaseoDaemon(
     // CORS - allow same-origin + configured origins
     const allowedOrigins = new Set([
       ...config.corsAllowedOrigins,
-      // Packaged desktop renderers may send `file://` or `null` as the origin.
-      "file://",
-      "null",
+      // Packaged desktop renderers use the custom paseo:// protocol scheme.
+      "paseo://app",
       // For TCP, add localhost variants
       ...(listenTarget.type === "tcp"
         ? [