diff --git a/analysis_results.md b/analysis_results.md
index 2e855e2..9998685 100644
--- a/analysis_results.md
+++ b/analysis_results.md
@@ -28,9 +28,18 @@ RUN chown -R appuser:appuser /app && \
 CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8080} --proxy-headers"]
 ```
 
+### 2. Update `frontend/firebase.json`
+- **Updated `site` ID**: Changed from the default project ID to `philo-rag` to deploy correctly to the `philo-rag.web.app` URL.
+
+### 3. Update `backend/app/main.py`
+- **Explicit CORS Origins**: Replaced the wildcard `["*"]` with an explicit list of origins. Browsers reject `*` when `allow_credentials=True` is used, so defining the specific Firebase and localhost URLs was necessary to fix the "Failed to fetch" errors.
+
 ## Next Steps
-1. **Commit the changes**: The fixed `Dockerfile` is now ready to be pushed to the repository.
-2. **Re-run the GitHub Action**: PR을 `main` 브랜치에 머지(merge)하면 GitHub Actions 워크플로우가 트리거됩니다.
+1. **Commit the changes**: The fixed `Dockerfile`, `main.py`, and `firebase.json` are now ready to be pushed to the repository.
+2. **Re-run the GitHub Action**: When you merge the PR into the `main` branch, the GitHub Actions workflow is triggered.
+3. **Verify the results**: 
+   - Backend URL: Check readiness at `https://[SUBDOMAIN].a.run.app/ready`
+   - Frontend URL: Check `https://philo-rag.web.app/`
 
 > [!TIP]
 > Once the deployment is successful, you can verify the status through the Cloud Run URL or the readiness check endpoint: `/ready`.
diff --git a/backend/app/core/config.py b/backend/app/core/config.py
index 5b528cf..171b460 100644
--- a/backend/app/core/config.py
+++ b/backend/app/core/config.py
@@ -23,8 +23,10 @@ class Settings(BaseSettings):
 
 settings = Settings()
 
-# Fail-fast validation: ensure essential secrets are configured at startup
-if not settings.SUPABASE_URL or not settings.SUPABASE_SERVICE_KEY:
-    raise RuntimeError(
-        "SUPABASE_URL and SUPABASE_SERVICE_KEY (or SUPABASE_SERVICE_ROLE_KEY) must be configured in environment variables."
-    )
+def validate_required_settings() -> None:
+    """Fail-fast validation: ensure essential secrets are configured."""
+    if not settings.SUPABASE_URL or not settings.SUPABASE_SERVICE_KEY:
+        raise RuntimeError(
+            "SUPABASE_URL and SUPABASE_SERVICE_KEY (or SUPABASE_SERVICE_ROLE_KEY) "
+            "must be configured in environment variables."
+        )
diff --git a/backend/app/main.py b/backend/app/main.py
index 1a54eb4..90a405a 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -16,6 +16,10 @@
 
 @asynccontextmanager
 async def lifespan(_app: FastAPI):
+    # Ensure all required environment variables are set before proceeding
+    from app.core.config import validate_required_settings
+    validate_required_settings()
+    
     # Pre-load embedding model and LLM during startup in a background thread
     logger.info("Pre-loading models in background during startup...")
     
@@ -66,7 +70,13 @@ def _on_preload_done(task: asyncio.Task):
 # Configure CORS
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],  # Allows all origins for development
+    allow_origins=[
+        "http://localhost:3000",
+        "https://philo-rag.web.app",
+        "https://philo-rag.firebaseapp.com",
+        "https://vigilant-shift-490601-t5.web.app",
+        "https://vigilant-shift-490601-t5.firebaseapp.com",
+    ],
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
diff --git a/frontend/firebase.json b/frontend/firebase.json
index 173f59f..8fe7695 100644
--- a/frontend/firebase.json
+++ b/frontend/firebase.json
@@ -1,6 +1,6 @@
 {
   "hosting": {
-    "site": "vigilant-shift-490601-t5",
+    "site": "philo-rag",
     "public": "out",
     "ignore": [
       "firebase.json",