diff --git a/docs/18_domainCheck_CentOS9一键复制部署与更新文档.md b/docs/18_domainCheck_CentOS9一键复制部署与更新文档.md
index 9b4ec6c..bb72f18 100644
--- a/docs/18_domainCheck_CentOS9一键复制部署与更新文档.md
+++ b/docs/18_domainCheck_CentOS9一键复制部署与更新文档.md
@@ -165,6 +165,11 @@ git pull --ff-only origin main
 - 但国外机的一键脚本内部会自动识别仓库属主
 - 然后把前端构建切到仓库属主执行
 - 这样可以避免把 `node_modules`、`dist`、源码目录权限烧成 `root`
+- `/etc/default/domaincheck-api` 里的 `CORS_ORIGINS` 必须使用 JSON 数组格式
+- 正确示例：
+  - `CORS_ORIGINS='["https://admin.domain","http://127.0.0.1:3201","http://localhost:3201"]'`
+- 不能写成逗号拼接字符串：
+  - `CORS_ORIGINS=https://admin.domain,http://127.0.0.1:3201,http://localhost:3201`
 
 最稳的执行方式：
 
diff --git a/domain-api/.env.example b/domain-api/.env.example
index ce30220..5df1448 100644
--- a/domain-api/.env.example
+++ b/domain-api/.env.example
@@ -3,7 +3,7 @@ API_HOST=0.0.0.0
 API_PORT=8100
 
 # 允许访问 Web 后台的来源，多个地址用英文逗号分隔
-CORS_ORIGINS=http://127.0.0.1:3200,http://localhost:3200
+CORS_ORIGINS=["http://127.0.0.1:3200","http://localhost:3200"]
 
 DB_HOST=127.0.0.1
 DB_PORT=5432
diff --git a/domain-api/app/core/config.py b/domain-api/app/core/config.py
index 90b0909..2bc5bd7 100644
--- a/domain-api/app/core/config.py
+++ b/domain-api/app/core/config.py
@@ -1,6 +1,6 @@
+import json
 from pathlib import Path
 
-from pydantic import field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -15,7 +15,7 @@ class Settings(BaseSettings):
     api_prefix: str = "/api/v1"
     api_host: str = "0.0.0.0"
     api_port: int = 8100
-    cors_origins: list[str] = ["http://127.0.0.1:3200", "http://localhost:3200"]
+    cors_origins: str = "http://127.0.0.1:3200,http://localhost:3200"
     db_host: str = "127.0.0.1"
     db_port: int = 5432
     db_database: str = "domain"
@@ -43,14 +43,25 @@ class Settings(BaseSettings):
     sync_batch_size: int = 200
     sync_poll_interval_seconds: int = 30
 
-    @field_validator("cors_origins", mode="before")
-    @classmethod
-    def parse_cors_origins(cls, value: object) -> object:
-        if isinstance(value, str):
-            if value.strip().startswith("["):
-                return value
-            return [item.strip() for item in value.split(",") if item.strip()]
-        return value
+    @property
+    def cors_origins_list(self) -> list[str]:
+        value = self.cors_origins
+        if isinstance(value, list):
+            return [str(item).strip() for item in value if str(item).strip()]
+        if not isinstance(value, str):
+            return []
+        stripped = value.strip()
+        if not stripped:
+            return []
+        if stripped.startswith("["):
+            try:
+                parsed = json.loads(stripped)
+            except json.JSONDecodeError:
+                pass
+            else:
+                if isinstance(parsed, list):
+                    return [str(item).strip() for item in parsed if str(item).strip()]
+        return [item.strip() for item in stripped.split(",") if item.strip()]
 
     model_config = SettingsConfigDict(
         env_file=(str(API_ENV_FILE), str(ENV_FILE)),
diff --git a/domain-api/app/main.py b/domain-api/app/main.py
index 8a9989e..4ab0b6a 100644
--- a/domain-api/app/main.py
+++ b/domain-api/app/main.py
@@ -26,7 +26,7 @@ app = FastAPI(
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=app_settings.cors_origins,
+    allow_origins=app_settings.cors_origins_list,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
diff --git a/domain-api/deploy/multi-region/install_overseas_quick.sh b/domain-api/deploy/multi-region/install_overseas_quick.sh
index b94c53b..b130ec3 100755
--- a/domain-api/deploy/multi-region/install_overseas_quick.sh
+++ b/domain-api/deploy/multi-region/install_overseas_quick.sh
@@ -183,7 +183,7 @@ sed -i "s#^NODE_CODE=.*#NODE_CODE=${OVERSEAS_NODE_CODE}#" /etc/default/domainche
 sed -i 's#^NODE_REGION=.*#NODE_REGION=overseas#' /etc/default/domaincheck-api
 sed -i 's#^NODE_ROLE=.*#NODE_ROLE=control#' /etc/default/domaincheck-api
 sed -i 's#^SYNC_PUSH_ENABLED=.*#SYNC_PUSH_ENABLED=false#' /etc/default/domaincheck-api
-sed -i "s#^CORS_ORIGINS=.*#CORS_ORIGINS=https://${ADMIN_DOMAIN},http://127.0.0.1:3201,http://localhost:3201#" /etc/default/domaincheck-api
+sed -i "s#^CORS_ORIGINS=.*#CORS_ORIGINS='[\\\"https://${ADMIN_DOMAIN}\\\",\\\"http://127.0.0.1:3201\\\",\\\"http://localhost:3201\\\"]'#" /etc/default/domaincheck-api
 
 cp "${DOMAIN_API_DIR}/deploy/systemd/domain-api.service" /etc/systemd/system/domaincheck-api.service
 cp "${DOMAIN_API_DIR}/deploy/systemd/domain-worker.service" /etc/systemd/system/domaincheck-worker.service
diff --git a/domain-api/deploy/multi-region/templates/domaincheck-api.env.example b/domain-api/deploy/multi-region/templates/domaincheck-api.env.example
index 444859e..06b3b6f 100644
--- a/domain-api/deploy/multi-region/templates/domaincheck-api.env.example
+++ b/domain-api/deploy/multi-region/templates/domaincheck-api.env.example
@@ -5,7 +5,7 @@ DOMAIN_ROOT=__BASE_DIR__/domainCheck
 NODE_CODE=overseas-control-01
 NODE_REGION=overseas
 NODE_ROLE=control
-CORS_ORIGINS=http://127.0.0.1:3201,http://localhost:3201
+CORS_ORIGINS='["http://127.0.0.1:3201","http://localhost:3201"]'
 
 # DB
 # DB_HOST=127.0.0.1