diff --git a/src/servers/_middlewares/origin-validation.ts b/src/servers/_middlewares/origin-validation.ts
index 441d87ef..2d11b3b3 100644
--- a/src/servers/_middlewares/origin-validation.ts
+++ b/src/servers/_middlewares/origin-validation.ts
@@ -1,7 +1,7 @@
 import type { MiddlewareHandler } from 'hono';
 import * as errors from '../custom-errors';
 
-const { PUBLIC_BUILD_ENV } = process.env;
+const { PUBLIC_BUILD_ENV, EXPO_PUBLIC_CLIENT_ORIGIN } = process.env;
 
 const WEB_ORIGINS: Record<string, string[]> = {
   alpha: ['https://alpha.officer.dev'],
@@ -13,8 +13,9 @@ const CHROME_EXTENSIONS: string[] = [
 ];
 
 const APP_ORIGINS: string[] = [
-  // Future: mobile app / webview origins
-];
+  // Expo mobile app — an officer:// custom-scheme origin (with an embedded token), set via env.
+  EXPO_PUBLIC_CLIENT_ORIGIN,
+].filter((o): o is string => Boolean(o));
 
 export function isOriginAllowed(origin: string | undefined, host?: string): boolean {
   if (!PUBLIC_BUILD_ENV || PUBLIC_BUILD_ENV === 'dev' || PUBLIC_BUILD_ENV === 'development') {