diff --git a/astro.config.mjs b/astro.config.mjs
index 4c49f88..6e2067f 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -7,6 +7,9 @@ export default defineConfig({
   output: 'server',
   adapter: node({ mode: 'standalone' }),
   integrations: [react()],
+  // CSRF: eigener Schutz über SameSite=Lax-Session-Cookie. Astros checkOrigin
+  // bricht multipart-Uploads hinter dem Reverse-Proxy (http↔https-Mismatch).
+  security: { checkOrigin: false },
   server: { host: true, port: Number(process.env.PORT) || 4321 },
   vite: {
     ssr: {