diff --git a/roles/bodhi2/base/templates/production.ini.j2 b/roles/bodhi2/base/templates/production.ini.j2
index 6f0778e5da..8f2bb25aeb 100644
--- a/roles/bodhi2/base/templates/production.ini.j2
+++ b/roles/bodhi2/base/templates/production.ini.j2
@@ -358,7 +358,7 @@ openid_template = {username}.id.fedoraproject.org
 # This can be wide-open.  read-only, we don't care as much about.
 cors_origins_ro = *
 # This should be more locked down to avoid cross-site request forgery.
-cors_origins_rw = bodhi.fedoraproject.org
+cors_origins_rw = https://bodhi.fedoraproject.org
 cors_connect_src = https://*.fedoraproject.org/ wss://hub.fedoraproject.org:9939/
 
 
diff --git a/roles/bodhi2/base/templates/staging.ini.j2 b/roles/bodhi2/base/templates/staging.ini.j2
index 9cec2669ea..b5785ef9c7 100644
--- a/roles/bodhi2/base/templates/staging.ini.j2
+++ b/roles/bodhi2/base/templates/staging.ini.j2
@@ -359,7 +359,7 @@ openid_template = {username}.id.fedoraproject.org
 # This can be wide-open.  read-only, we don't care as much about.
 cors_origins_ro = *
 # This should be more locked down to avoid cross-site request forgery.
-cors_origins_rw = bodhi.stg.fedoraproject.org
+cors_origins_rw = https://bodhi.stg.fedoraproject.org
 cors_connect_src = https://*.fedoraproject.org/ wss://hub.fedoraproject.org:9939/