diff --git a/backend/internal/config/config_test.go b/backend/internal/config/config_test.go
index a149dfdf..2ab389e8 100644
--- a/backend/internal/config/config_test.go
+++ b/backend/internal/config/config_test.go
@@ -348,6 +348,21 @@ func TestLoadWithEnv_ProductionRequiresOverlay(t *testing.T) {
 	assert.ErrorContains(t, err, "production config overlay not found")
 }
 
+func TestLoadWithEnv_CORSYAMLRoundTrip(t *testing.T) {
+	tmpDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "config.yaml"), []byte(`server:
+  cors:
+    allowed_origins: ["https://chat.acme.test"]
+    allow_credentials: true
+`), 0o644))
+	t.Chdir(tmpDir)
+
+	cfg, err := LoadWithEnv("default")
+	require.NoError(t, err)
+	require.Equal(t, []string{"https://chat.acme.test"}, cfg.Server.CORS.AllowedOrigins)
+	require.True(t, cfg.Server.CORS.AllowCredentials)
+}
+
 func TestLoadWithEnv_ProductionOverlay(t *testing.T) {
 	t.Setenv("GOCHAT_DATABASE_DSN", "postgres://gochat:database-secret@db.acme.test:5432/gochat?sslmode=verify-full")
 	t.Setenv("GOCHAT_REDIS_DSN", "rediss://:redis-secret@redis.acme.test:6379")