diff --git a/hosts/mainframe/sunshine/sunshine.conf b/hosts/mainframe/sunshine/sunshine.conf
index 72a44ff..da48c39 100644
--- a/hosts/mainframe/sunshine/sunshine.conf
+++ b/hosts/mainframe/sunshine/sunshine.conf
@@ -15,3 +15,13 @@ nvenc_preset = 1
 nvenc_twopass = quarter_res
 
 min_log_level = warning
+
+# The web UI is reached from other machines on the LAN, so their Origin header
+# names this host rather than localhost and Sunshine's CSRF check rejects it.
+# Both spellings are listed because the browser sends whichever you typed.
+# Comma-separated bare origins — not a JSON array; brackets and quotes are
+# rejected entry by entry.
+csrf_allowed_origins = https://10.0.0.2:47990,https://mainframe:47990,https://localhost:47990
+
+# Web UI reachable from the LAN, not just this machine.
+origin_web_ui_allowed = lan