diff --git a/src/google/adk/cli/adk_web_server.py b/src/google/adk/cli/adk_web_server.py
index 3a471c1157..35d100eb98 100644
--- a/src/google/adk/cli/adk_web_server.py
+++ b/src/google/adk/cli/adk_web_server.py
@@ -642,6 +642,7 @@ def get_fast_api_app(
       self,
       lifespan: Optional[Lifespan[FastAPI]] = None,
       allow_origins: Optional[list[str]] = None,
+      allow_origin_regex: Optional[str] = None,
       web_assets_dir: Optional[str] = None,
       setup_observer: Callable[
           [Observer, "AdkWebServer"], None
@@ -713,14 +714,20 @@ async def internal_lifespan(app: FastAPI):
     # Run the FastAPI server.
     app = FastAPI(lifespan=internal_lifespan)
 
-    if allow_origins:
-      app.add_middleware(
-          CORSMiddleware,
-          allow_origins=allow_origins,
-          allow_credentials=True,
-          allow_methods=["*"],
-          allow_headers=["*"],
-      )
+    if allow_origins or allow_origin_regex:
+      cors_kwargs = {
+          "allow_credentials": True,
+          "allow_methods": ["*"],
+          "allow_headers": ["*"],
+      }
+
+      if allow_origins:
+        cors_kwargs["allow_origins"] = allow_origins
+
+      if allow_origin_regex:
+        cors_kwargs["allow_origin_regex"] = allow_origin_regex
+
+      app.add_middleware(CORSMiddleware, **cors_kwargs)
 
     @app.get("/list-apps")
     async def list_apps(
diff --git a/src/google/adk/cli/cli_tools_click.py b/src/google/adk/cli/cli_tools_click.py
index 66f4dbe455..d38bacb306 100644
--- a/src/google/adk/cli/cli_tools_click.py
+++ b/src/google/adk/cli/cli_tools_click.py
@@ -1005,6 +1005,10 @@ def decorator(func):
         help="Optional. Any additional origins to allow for CORS.",
         multiple=True,
     )
+    @click.option(
+        "--allow_origin_regex",
+        help="Optional. A regex pattern for additional origins to allow for CORS.",
+    )
     @click.option(
         "-v",
         "--verbose",
@@ -1223,6 +1227,7 @@ def cli_api_server(
     eval_storage_uri: Optional[str] = None,
     log_level: str = "INFO",
     allow_origins: Optional[list[str]] = None,
+    allow_origin_regex: Optional[str] = None,
     host: str = "127.0.0.1",
     port: int = 8000,
     url_prefix: Optional[str] = None,
@@ -1259,6 +1264,7 @@ def cli_api_server(
           memory_service_uri=memory_service_uri,
           eval_storage_uri=eval_storage_uri,
           allow_origins=allow_origins,
+          allow_origin_regex=allow_origin_regex,
           web=False,
           trace_to_cloud=trace_to_cloud,
           otel_to_cloud=otel_to_cloud,
diff --git a/src/google/adk/cli/fast_api.py b/src/google/adk/cli/fast_api.py
index 131213ec07..8967a52600 100644
--- a/src/google/adk/cli/fast_api.py
+++ b/src/google/adk/cli/fast_api.py
@@ -78,6 +78,7 @@ def get_fast_api_app(
     memory_service_uri: Optional[str] = None,
     eval_storage_uri: Optional[str] = None,
     allow_origins: Optional[list[str]] = None,
+    allow_origin_regex: Optional[str] = None,
     web: bool,
     a2a: bool = False,
     host: str = "127.0.0.1",
@@ -207,6 +208,7 @@ def tear_down_observer(observer: Observer, _: AdkWebServer):
   app = adk_web_server.get_fast_api_app(
       lifespan=lifespan,
       allow_origins=allow_origins,
+      allow_origin_regex=allow_origin_regex,
       otel_to_cloud=otel_to_cloud,
       **extra_fast_api_args,
   )