diff --git a/serving/fleet-manager/webauthn.go b/serving/fleet-manager/webauthn.go
index bc460ed..6500a8d 100644
--- a/serving/fleet-manager/webauthn.go
+++ b/serving/fleet-manager/webauthn.go
@@ -15,6 +15,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
@@ -191,9 +192,18 @@ func newWebAuthn(cfg config) (*webauthn.WebAuthn, error) {
 	if cfg.rpID == "" || cfg.rpOrigin == "" {
 		return nil, fmt.Errorf("WebAuthn needs FLEET_MGR_RP_ID and FLEET_MGR_RP_ORIGIN (the admin UI hostname/origin)")
 	}
+	// FLEET_MGR_RP_ORIGIN may list several exact origins (comma-separated) — e.g.
+	// the direct :9500 form and a 443-proxy form — since passkeys bind to the
+	// exact scheme://host:port the browser used. Each must match a real origin.
+	var origins []string
+	for _, o := range strings.Split(cfg.rpOrigin, ",") {
+		if o = strings.TrimSpace(o); o != "" {
+			origins = append(origins, o)
+		}
+	}
 	return webauthn.New(&webauthn.Config{
 		RPID:          cfg.rpID,
 		RPDisplayName: cfg.rpDisplayName,
-		RPOrigins:     []string{cfg.rpOrigin},
+		RPOrigins:     origins,
 	})
 }