diff --git a/roles/bodhi2/base/templates/production.ini.j2 b/roles/bodhi2/base/templates/production.ini.j2
index e500a51b75..bc42f0a9e0 100644
--- a/roles/bodhi2/base/templates/production.ini.j2
+++ b/roles/bodhi2/base/templates/production.ini.j2
@@ -555,7 +555,11 @@ cors_origins_ro = *
 # This should be more locked down to avoid cross-site request forgery.
 cors_origins_rw = https://bodhi{{env_suffix}}.fedoraproject.org
 
-cors_connect_src = https://*.{{env_suffix}}fedoraproject.org/ wss://hub.{{env_suffix}}fedoraproject.org:9939/
+{% if env == 'production' %}
+cors_connect_src = https://*.fedoraproject.org/ wss://hub.fedoraproject.org:9939/
+{% elif env == 'staging' %}
+cors_connect_src = https://*.stg.fedoraproject.org/ wss://hub.stg.fedoraproject.org:9939/
+{% endif %}
 
 
 ##