diff --git a/scripts/local-setup.sh b/scripts/local-setup.sh
index 94b21dca..032bf635 100755
--- a/scripts/local-setup.sh
+++ b/scripts/local-setup.sh
@@ -209,7 +209,23 @@ env_set LOCAL_DOMAIN "$LOCAL_DOMAIN"
 env_set LOCAL_IP     "$LOCAL_IP"
 env_set BASE_URL              "https://$LOCAL_DOMAIN"
 env_set PUBLIC_BASE_URL       "https://$LOCAL_DOMAIN"
-env_set ALLOWED_ORIGINS       "https://$LOCAL_DOMAIN,https://$LOCAL_IP"
+# Merge — never overwrite — ALLOWED_ORIGINS so operator-added origins
+# (e.g. a Tailscale name, an extra LAN IP) are preserved across re-runs.
+EXISTING_ORIGINS="$(env_get ALLOWED_ORIGINS)"
+NEW_ORIGINS="https://$LOCAL_DOMAIN,https://$LOCAL_IP"
+MERGED_ORIGINS="$NEW_ORIGINS"
+if [ -n "$EXISTING_ORIGINS" ]; then
+  IFS=',' read -r -a _existing_arr <<< "$EXISTING_ORIGINS"
+  for o in "${_existing_arr[@]}"; do
+    o="$(printf "%s" "$o" | sed -e 's/^ *//' -e 's/ *$//')"
+    [ -z "$o" ] && continue
+    case ",$MERGED_ORIGINS," in
+      *",$o,"*) ;;  # already present
+      *) MERGED_ORIGINS="$MERGED_ORIGINS,$o" ;;
+    esac
+  done
+fi
+env_set ALLOWED_ORIGINS       "$MERGED_ORIGINS"
 # Default HTTPS_MODE to "local" only if not already set (preserves byo/skip).
 if [ -z "$(env_get HTTPS_MODE)" ]; then
   env_set HTTPS_MODE "local"