diff --git a/server/src/main.rs b/server/src/main.rs
index d6792e8..b3d0788 100755
--- a/server/src/main.rs
+++ b/server/src/main.rs
@@ -39,10 +39,13 @@ async fn main() -> std::io::Result<()> {
     HttpServer::new(move || {
         let cors = Cors::default()
             .allowed_origin("https://shitpost.se")
-            .allowed_origin("http://localhost:8080")
             .allowed_methods(vec!["GET", "POST"])
             .max_age(3600);
 
+        // In debug mode, allow localhost
+        #[cfg(debug_assertions)]
+        let cors = cors.allowed_origin("http://localhost:8080");
+
         App::new()
             .wrap(cors)
             .wrap(middleware::Compress::default())