- Update Hydra and Kratos CORS config to specify allowed origins explicitly instead of using wildcard with allow_credentials: true - Fix Nginx upstream resolution for Oathkeeper to use correct container hostname (ory_oathkeeper)