diff --git a/backend/settings/development.yaml b/backend/settings/development.yaml
index f89252b..e974eee 100644
--- a/backend/settings/development.yaml
+++ b/backend/settings/development.yaml
@@ -1,4 +1,4 @@
-frontend_url: http://localhost:3000
+frontend_url: http://localhost:5173
 debug: true
 
 application:
@@ -6,3 +6,8 @@ application:
   host: 127.0.0.1
   base_url: http://127.0.0.1:3100
   name: "sta-dev"
+
+cors:
+  allowed_origins: ["*"]
+  allow_credentials: false
+  max_age_secs: 3600
diff --git a/specs/001-modbus-relay-control/tasks.md b/specs/001-modbus-relay-control/tasks.md
index 1add467..0620acd 100644
--- a/specs/001-modbus-relay-control/tasks.md
+++ b/specs/001-modbus-relay-control/tasks.md
@@ -89,14 +89,14 @@
   - **File**: backend/src/settings.rs
   - **Complexity**: Low | **Uncertainty**: Low
 
-- [ ] **T011** [Setup] [TDD] Update development.yaml with permissive CORS settings
+- [x] **T011** [Setup] [TDD] Update development.yaml with permissive CORS settings
   - Add cors section with `allowed_origins: ["*"]`, `allow_credentials: false`, `max_age_secs: 3600`
   - Update `frontend_url` from `http://localhost:3000` to `http://localhost:5173` (Vite default port)
   - **Test**: cargo run loads development config without errors
   - **File**: backend/settings/development.yaml
   - **Complexity**: Low | **Uncertainty**: Low
 
-- [ ] **T012** [P] [Setup] [TDD] Create production.yaml with restrictive CORS settings
+- [x] **T012** [P] [Setup] [TDD] Create production.yaml with restrictive CORS settings
   - Add cors section with `allowed_origins: ["REACTED"]`, `allow_credentials: true`, `max_age_secs: 3600`
   - Add `frontend_url: "https://REDACTED"`
   - Add production-specific application settings (protocol: https, host: 0.0.0.0)