diff --git a/.env.example b/.env.example
index 7913f204..0b4321b5 100644
--- a/.env.example
+++ b/.env.example
@@ -10,11 +10,11 @@
 
 # --- App ---------------------------------------------------------------
 NODE_ENV=development
-PORT=3000
+PORT=3001
 # Public URL of this API, used to build OAuth callback / webhook URLs
-APP_URL=http://localhost:3000
+APP_URL=http://localhost:3001
 # Frontend URL, used for CORS + OAuth redirect back to the SPA
-FRONTEND_URL=http://localhost:3001
+FRONTEND_URL=http://localhost:3000
 
 # --- Database (PostgreSQL via TypeORM) ----------------------------------
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/mergefi
diff --git a/src/config/configuration.ts b/src/config/configuration.ts
index 40e91db2..d6400031 100644
--- a/src/config/configuration.ts
+++ b/src/config/configuration.ts
@@ -69,9 +69,16 @@ export interface AppConfig {
 
 export default (): AppConfig => ({
   env: process.env.NODE_ENV ?? 'development',
-  port: parseInt(process.env.PORT ?? '3000', 10),
-  appUrl: process.env.APP_URL ?? 'http://localhost:3000',
-  frontendUrl: process.env.FRONTEND_URL ?? 'http://localhost:3001',
+  // The frontend's `next dev` occupies 3000 — the backend's default is 3001
+  // so a fresh dev setup doesn't port-collide (#590).
+  port: parseInt(process.env.PORT ?? '3001', 10),
+  // FRONTEND_URL is the CORS origin + OAuth redirect target — it must match
+  // where the frontend actually serves. `next dev` runs on 3000, so the old
+  // 3001 default made CORS reject the frontend's origin and OAuth redirect
+  // wrong (#590). And the backend's own default PORT must differ from the
+  // frontend's 3000 — moved to 3001 so dev defaults don't collide.
+  appUrl: process.env.APP_URL ?? 'http://localhost:3001',
+  frontendUrl: process.env.FRONTEND_URL ?? 'http://localhost:3000',
   logLevel: process.env.LOG_LEVEL ?? 'debug',
   database: {
     url: