diff --git a/backend/src/middleware/cors.ts b/backend/src/middleware/cors.ts
index afb37f9..d183ff8 100644
--- a/backend/src/middleware/cors.ts
+++ b/backend/src/middleware/cors.ts
@@ -1,9 +1,14 @@
 import cors from "cors";
 
+// Regex cobre qualquer preview do Vercel: painel-vagas-*.vercel.app
+// (hash-based e branch-based, ex: git-master-bene-teslas-projects)
+const VERCEL_PREVIEW_RE = /^https:\/\/painel-vagas-[a-z0-9-]+\.vercel\.app$/;
+
 const DEFAULT_ALLOWED_ORIGINS = [
   "https://painel-vagas-lake.vercel.app",
+  "https://painel-vagas-git-master-bene-teslas-projects.vercel.app",
+  "https://painel-vagas-m6hbzlqeh-bene-teslas-projects.vercel.app",
   "https://jobsglobalscraper.ddns.net",
-  "http://jobsglobalscraper.ddns.net",
   "http://localhost:5173",
   "http://localhost:5174",
 ];
@@ -18,19 +23,14 @@ function parseAllowedOrigins(value: string | undefined): Set<string> {
 
 export const corsOptions: cors.CorsOptions = {
   origin(origin, callback) {
-    const allowedOrigins = parseAllowedOrigins(
-      process.env.CORS_ALLOWED_ORIGINS,
-    );
-
     if (!origin) return callback(null, true);
 
-    if (/^https:\/\/painel-vagas-[a-z0-9-]+\.vercel\.app$/.test(origin)) {
-      return callback(null, true);
-    }
+    if (VERCEL_PREVIEW_RE.test(origin)) return callback(null, true);
 
+    const allowedOrigins = parseAllowedOrigins(process.env.CORS_ALLOWED_ORIGINS);
     if (allowedOrigins.has(origin)) return callback(null, true);
 
-    callback(new Error(`Origin not allowed by CORS: ${origin}`));
+    callback(new Error("Origin not allowed by CORS"));
   },
   methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
   allowedHeaders: ["Content-Type", "Authorization", "X-Requested-With"],
diff --git a/frontend/vercel.json b/frontend/vercel.json
index 831e9b7..e06a47c 100644
--- a/frontend/vercel.json
+++ b/frontend/vercel.json
@@ -2,7 +2,7 @@
   "rewrites": [
     {
       "source": "/api/(.*)",
-      "destination": "http://jobsglobalscraper.ddns.net/api/$1"
+      "destination": "https://jobsglobalscraper.ddns.net/api/$1"
     },
     {
       "source": "/(.*)",
diff --git a/vercel.json b/vercel.json
index a2cc74d..d45c354 100644
--- a/vercel.json
+++ b/vercel.json
@@ -2,7 +2,7 @@
   "rewrites": [
     {
       "source": "/api/(.*)",
-      "destination": "http://jobsglobalscraper.ddns.net/api/$1"
+      "destination": "https://jobsglobalscraper.ddns.net/api/$1"
     },
     {
       "source": "/((?!api/).*)",