diff --git a/svelte.config.js b/svelte.config.js
index e31dff0..40dc908 100644
--- a/svelte.config.js
+++ b/svelte.config.js
@@ -9,6 +9,18 @@ const config = {
         alias: {
             $ui: 'src/lib/ui',
             '$ui/*': 'src/lib/ui/*'
+        },
+        // Electric Cherry is a private-network fleet manager reached via
+        // whatever hostname/port the operator's proxy exposes it on. Origin
+        // headers get rewritten en route (reverse proxies, LAN IPs, .local
+        // hostnames), so SvelteKit's default cross-site POST guard blocks
+        // legitimate multipart uploads from our own UI. There is no
+        // cross-origin surface to defend against here — the app only accepts
+        // traffic from inside the LAN — so turn the guard off. If this ever
+        // gets exposed to the public internet, add per-route origin checks in
+        // hooks.server.ts instead of re-enabling this blanket rule.
+        csrf: {
+            checkOrigin: false
         }
     }
 };