diff --git a/README.md b/README.md
index 3c0df38..7a3a013 100644
--- a/README.md
+++ b/README.md
@@ -249,9 +249,12 @@ Key settings in more detail:
 
 - `access_control_allow_origin` — the origin a browser lets read pixa's
   responses, sent as the CORS `Access-Control-Allow-Origin` header: `*`, the
-  default, is any site; otherwise one origin: scheme, host and optional port,
-  exactly as the browser sends it, such as `https://example.com`. Anything
-  else aborts startup
+  default, is any site; otherwise one `http` or `https` origin such as
+  `https://example.com`, whose host is a lowercase host name (letters,
+  digits, hyphens and dots, with a letter in its last part) or an IP address
+  (IPv6 in brackets, in its shortest form), with an optional port 1-65535
+  that has no leading zero and is not the scheme's default. Any other value,
+  including another scheme such as a browser extension's, aborts startup
 - `allowlist_hosts` — list of allowed upstream hosts
 - `blocked_networks` — list of CIDR ranges to refuse for SSRF protection,
   added to the always-enforced built-in ranges (loopback, private,
diff --git a/TODO.md b/TODO.md
index b619ac9..e6ad439 100644
--- a/TODO.md
+++ b/TODO.md
@@ -64,8 +64,8 @@ exhaustion
   (default 50 MiB) and `downstream_timeout` (default `60s`, both the
   server's write timeout and the per-request timeout); each has a
   `PIXA_` variable; durations are positive Go duration strings, the size a
-  whole number of bytes up to 1 GiB, the origin `*` or one scheme, host
-  and optional port, exactly as the browser sends it; an invalid value
+  whole number of bytes up to 1 GiB, the origin `*` or one `http` or
+  `https` origin as `README.md` describes it; an invalid value
   aborts startup naming the key and the value; documented in
   `config.example.yml` and `README.md`.
 - 2026-09-28 cache stats report real numbers (closes #56): `Cache.Stats`
diff --git a/config.example.yml b/config.example.yml
index 562e3a5..27c2422 100644
--- a/config.example.yml
+++ b/config.example.yml
@@ -84,8 +84,12 @@ downstream_timeout: 60s
 
 # The origin a browser lets read pixa's responses, sent as the CORS
 # Access-Control-Allow-Origin header: "*" (the default) is any site;
-# otherwise one origin: scheme, host and optional port, exactly as the
-# browser sends it, such as https://example.com
+# otherwise one http or https origin such as https://example.com, whose
+# host is a lowercase host name (letters, digits, hyphens and dots, with a
+# letter in its last part) or an IP address (IPv6 in brackets, in its
+# shortest form), with an optional port 1-65535 that has no leading zero
+# and is not the scheme's default. Any other value, including another
+# scheme such as a browser extension's, aborts startup.
 access_control_allow_origin: "*"
 
 # Maximum disk cache size in bytes. Explicit values are used exactly as