diff --git a/stacks/skaldsong/.env.example b/stacks/skaldsong/.env.example
index 90b3da5..aa6492b 100644
--- a/stacks/skaldsong/.env.example
+++ b/stacks/skaldsong/.env.example
@@ -51,9 +51,12 @@ WORLDTREE_BASE_URL=http://10.250.50.152:8080
 # prior nh3-dev hand-launch.
 SKALDSONG_HOST_WIZARD_AGENT_ID=skaldsong:wizard-v2
 
-# CORS — comma-separated origins. Include the SPA's public hostname AND
-# any dev origins still in rotation.
-SKALDSONG_HOST_CORS_ORIGINS=http://10.250.50.70:8300
+# CORS — JSON array of origins. Pydantic-settings parses complex-typed
+# env vars via json.loads(), so the value MUST be a JSON array literal
+# (a bare URL string fails first-boot with `SettingsError: error
+# parsing value for field "cors_origins"`). Include the SPA's public
+# hostname AND any dev origins still in rotation.
+SKALDSONG_HOST_CORS_ORIGINS=["http://10.250.50.70:8300"]
 
 # TTS — Kokoro on irv-ml1, reached over WireGuard via ana-wg. Same URL
 # works fleet-wide; the WG tunnel handles the cross-site routing.
diff --git a/stacks/skaldsong/compose.yaml b/stacks/skaldsong/compose.yaml
index e8d58a7..c822388 100644
--- a/stacks/skaldsong/compose.yaml
+++ b/stacks/skaldsong/compose.yaml
@@ -73,9 +73,10 @@ services:
       SKALDSONG_TTS_ENGINE: "${SKALDSONG_TTS_ENGINE:-kokoro}"
       SKALDSONG_TTS_BASE_URL: "${SKALDSONG_TTS_BASE_URL:-http://10.100.79.3:8193}"
 
-      # SPA static assets — baked into the image at /app/web/dist by the
-      # Dockerfile's web-builder stage.
-      SKALDSONG_HOST_STATIC_ASSETS_PATH: /app/web/dist
+      # SPA static assets — baked into the image at /app/spa by the
+      # Dockerfile's web-builder stage (COPYs the SvelteKit build output
+      # flat into /app/spa, not into /app/spa/dist).
+      SKALDSONG_HOST_STATIC_ASSETS_PATH: /app/spa
 
       # Persistent state paths inside the container. The db/ parent
       # dir is the bind-mount target (not the file itself) so SQLite