diff --git a/package.json b/package.json
index d2654f2..f3de1f6 100755
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
     "db:wal": "node scripts/sqlite-wal.mjs",
     "db:backup": "node scripts/sqlite-backup.mjs",
     "test": "bun test",
-    "test:e2e": "playwright test --config playwright-dyad.config.ts",
+    "test:e2e": "pnpm build && playwright test --config playwright-dyad.config.ts",
     "typecheck": "next build --webpack && tsc --noEmit --pretty false"
   },
   "dependencies": {
diff --git a/playwright-dyad.config.ts b/playwright-dyad.config.ts
index 56cda24..0f1a3c3 100644
--- a/playwright-dyad.config.ts
+++ b/playwright-dyad.config.ts
@@ -13,7 +13,7 @@ export default defineConfig({
   webServer: process.env.DYAD_TEST_BASE_URL
     ? undefined
     : {
-        command: "pnpm dev --hostname 127.0.0.1 --port 32104",
+        command: "pnpm start --hostname 127.0.0.1 --port 32104",
         url: "http://127.0.0.1:32104",
         reuseExistingServer: !process.env.CI,
         timeout: 120_000,
diff --git a/src/lib/csrf.ts b/src/lib/csrf.ts
index 8552c2d..42db12f 100644
--- a/src/lib/csrf.ts
+++ b/src/lib/csrf.ts
@@ -34,6 +34,8 @@ export function isTrustedRequestOrigin(request: Request): boolean {
   if (process.env.NODE_ENV !== 'production') {
     allowedOrigins.add('http://localhost:3000');
     allowedOrigins.add('http://127.0.0.1:3000');
+    allowedOrigins.add('http://localhost:32104');
+    allowedOrigins.add('http://127.0.0.1:32104');
   }
 
   const suppliedOrigin = origin ?? referer;