diff --git a/AGENTS.md b/AGENTS.md
index fcdb37ed..e4b5b514 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -40,7 +40,7 @@ pnpm dev
 This starts:
 
 - API: `http://localhost:3100`
-- UI: `http://localhost:5173`
+- UI: `http://localhost:3100` (served by API server in dev middleware mode)
 
 Quick checks:
 
@@ -140,4 +140,3 @@ A change is done when all are true:
 2. Typecheck, tests, and build pass
 3. Contracts are synced across db/shared/server/ui
 4. Docs updated when behavior or commands change
-
diff --git a/README.md b/README.md
index d4be3aae..b527ad1f 100644
--- a/README.md
+++ b/README.md
@@ -218,7 +218,6 @@ By default, agents run on scheduled heartbeats and event-based triggers (task as
 ```bash
 pnpm dev              # Full dev (API + UI)
 pnpm dev:server       # Server only
-pnpm dev:ui           # UI only
 pnpm build            # Build all
 pnpm typecheck        # Type checking
 pnpm test:run         # Run tests
diff --git a/server/src/__tests__/board-mutation-guard.test.ts b/server/src/__tests__/board-mutation-guard.test.ts
index 1ef1d495..626f8717 100644
--- a/server/src/__tests__/board-mutation-guard.test.ts
+++ b/server/src/__tests__/board-mutation-guard.test.ts
@@ -46,7 +46,7 @@ describe("boardMutationGuard", () => {
     const app = createApp("board");
     const res = await request(app)
       .post("/mutate")
-      .set("Origin", "http://localhost:5173")
+      .set("Origin", "http://localhost:3100")
       .send({ ok: true });
     expect(res.status).toBe(204);
   });
@@ -55,7 +55,7 @@ describe("boardMutationGuard", () => {
     const app = createApp("board");
     const res = await request(app)
       .post("/mutate")
-      .set("Referer", "http://localhost:5173/issues/abc")
+      .set("Referer", "http://localhost:3100/issues/abc")
       .send({ ok: true });
     expect(res.status).toBe(204);
   });
diff --git a/server/src/middleware/board-mutation-guard.ts b/server/src/middleware/board-mutation-guard.ts
index e77cb8d4..031fdfe3 100644
--- a/server/src/middleware/board-mutation-guard.ts
+++ b/server/src/middleware/board-mutation-guard.ts
@@ -2,8 +2,6 @@ import type { Request, RequestHandler } from "express";
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 const DEFAULT_DEV_ORIGINS = [
-  "http://localhost:5173",
-  "http://127.0.0.1:5173",
   "http://localhost:3100",
   "http://127.0.0.1:3100",
 ];