diff --git a/apps/api/config/application.rb b/apps/api/config/application.rb
index b3799d4..98d3bef 100644
--- a/apps/api/config/application.rb
+++ b/apps/api/config/application.rb
@@ -24,7 +24,7 @@ module Api
 
     # Traefik terminates SSL so Rails sees HTTP internally; disable the origin
     # header check (CSRF token itself is still validated)
-    config.action_dispatch.forgery_protection_origin_check = false
+    config.action_controller.forgery_protection_origin_check = false
 
     config.autoload_lib(ignore: %w[assets tasks])
   end