diff --git a/src/app.factory.ts b/src/app.factory.ts
index 28a3855..7acca08 100644
--- a/src/app.factory.ts
+++ b/src/app.factory.ts
@@ -11,7 +11,7 @@ import {feedbackRouter} from './models/feedback/Feedback.router.js';
 import {ticketsRouter} from './models/tickets/Tickets.router.js';
 import {adminRouter} from './models/admin/Admin.router.js';
 import {auth} from './models/admin/admin.auth.js';
-import {ADMIN_ALLOWED_ORIGINS} from './models/admin/admin.config.js';
+import {ADMIN_ALLOWED_ORIGINS, isProd} from './models/admin/admin.config.js';
 
 
 dotenv.config();
@@ -47,7 +47,15 @@ export const createApp = (): express.Application => {
 		// staging host does not need a code change here.
 		...ADMIN_ALLOWED_ORIGINS
 	];
-	const isDev = process.env.NODE_ENV !== 'production';
+	// `isProd` from admin.config, NOT `NODE_ENV !== 'production'`. The two are not
+	// the same when NODE_ENV is unset, which is exactly what a fresh Plesk vhost
+	// gives you: the old test called that "dev" and opened the loopback and
+	// private-LAN exceptions below. With `credentials: true` on this CORS config
+	// and a session cookie scoped to .nachklang.art, that let any page served
+	// from localhost read a signed-in admin's data cross-origin. admin.config
+	// treats anything but an explicit 'development'/'test' as production, so an
+	// unset value now fails closed.
+	const isDev = !isProd;
 	const localhostRegex = /^http:\/\/localhost:\d+$/;
 	// Matches http://<private-LAN-IPv4>:<port> - needed so the feedback form can
 	// be reached from a real phone over WiFi during dev (the phone's Origin is