diff --git a/docker-compose.yml b/docker-compose.yml
index 15a1c8f..723d7e8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -41,7 +41,11 @@ services:
       DATABASE_URL: postgresql+asyncpg://track:track_prod_2026@track_db:5432/track_production
       SECRET_KEY: change-me-in-production
       DEBUG: "true"
-      CORS_ORIGINS: '["http://localhost:8010","https://localhost:8010","http://192.168.9.80:8010","https://192.168.9.80:8010","tauri://localhost"]'
+      # 8010 = PC 管理端；5173/8020 = track-uniapp 的 H5 调试服务
+      # （HBuilderX「运行到浏览器」起在 5173，直接跑 vite 按 track-uniapp/vite.config.ts 是 8020）。
+      # ⚠️ 漏了 uniapp 的来源时，浏览器会在 CORS 预检阶段就掐掉请求，
+      #    表现是「点登录没反应」，且控制台只报一句笼统的 404/400。
+      CORS_ORIGINS: '["http://localhost:8010","https://localhost:8010","http://192.168.9.80:8010","https://192.168.9.80:8010","http://localhost:5173","https://localhost:5173","http://192.168.9.80:5173","https://192.168.9.80:5173","http://localhost:8020","https://localhost:8020","tauri://localhost"]'
       # 🚀 MOM 老系统数据库 — 通过容器名解析（projects_default 网络内 DNS），不再写死 IP
       MOM_DB_HOST: inventory_db
       MOM_DB_PORT: "5432"