diff --git a/k8s/helm/commonly/values-staging.yaml b/k8s/helm/commonly/values-staging.yaml
index 428f9b8da1..be6b0953da 100644
--- a/k8s/helm/commonly/values-staging.yaml
+++ b/k8s/helm/commonly/values-staging.yaml
@@ -121,6 +121,12 @@ backend:
     # every /v2 page errors. The same allowlist feeds the socket.io cors. Caught by the Tier-1
     # staging smoke 2026-10-23 (all /v2 renders failed on CORS until this landed).
     frontendUrl: "https://staging.commonly.me"
+    # The backend's public API origin. It sets the Atlassian connect hint ("allow
+    # <origin>/** in MCP server domains") and the CIMD and callback URLs. Unset, it falls
+    # back to the chart default (values.yaml: https://api.commonly.me), so staging told
+    # users to allow prod's API host. Staging's API is api-staging.commonly.me (the
+    # commonly-staging tunnel's ingressRules above).
+    backendUrl: "https://api-staging.commonly.me"
   # Staging backend runs on the SPOT pool at a fraction of prod's requests, so it fits
   # the nodes we already have (spot-pool sits at single-digit % CPU) without growing a
   # pool. Prod backend stays on dev-pool because it holds session state a spot