I’m encountering a CORS configuration issue in my Phoenix app during deployment due to a mismatch between compile-time and runtime configurations.

Current Setup

In endpoint.ex, before MyApp.Router, I have:

plug CORSPlug, origin: Application.compile_env(:my_app, :cors_origin)

In config.exs (for dev and test environments):

config :my_app,
  cors_origins: System.get_env("CORS_ORIGINS", "*") |> String.split(",")

In runtime.exs:

config :my_app,
  cors_origins: System.fetch_env!("CORS_ORIGINS") |> String.split(",")

The Issue

When deploying to production (using Fly.io), I encounter this error:

ERROR! the application :my_app has a different value set for key :cors_origins during runtime compared to compile time. Since this application environment entry was marked as compile time, this difference can lead to unexpected behavior:
* Compile time value was not set
* Runtime value was set to: ["http://localhost:5173"]

If I change endpoint.ex to use Application.get_env/2:

plug CORSPlug, origin: Application.get_env(:my_app, :cors_origin)

the app deploys successfully, but I see a warning that get_env/2 is discouraged in this context.

I’ve been troubleshooting this for about eight hours and could use some guidance. Am I overlooking something? Any help would be greatly appreciated!