diff --git a/cms/envs/devstack.py b/cms/envs/devstack.py
index 8ea4a8441000..f7b793559185 100644
--- a/cms/envs/devstack.py
+++ b/cms/envs/devstack.py
@@ -307,6 +307,14 @@ def should_show_debug_toolbar(request):  # lint-amnesty, pylint: disable=missing
 ############################ AI_TRANSLATIONS ##################################
 AI_TRANSLATIONS_API_URL = 'http://localhost:18760/api/v1'
 
+############################ CSRF ##################################
+
+# MFEs that will call this service in devstack
+CSRF_TRUSTED_ORIGINS = [
+    'http://localhost:3001',  # frontend-app-library-authoring
+    'http://localhost:2001',  # frontend-app-course-authoring
+]
+
 #################### Event bus backend ########################
 
 EVENT_BUS_PRODUCER = 'edx_event_bus_redis.create_producer'
diff --git a/lms/envs/devstack.py b/lms/envs/devstack.py
index e241852fddf0..d379283cce12 100644
--- a/lms/envs/devstack.py
+++ b/lms/envs/devstack.py
@@ -537,6 +537,16 @@ def should_show_debug_toolbar(request):  # lint-amnesty, pylint: disable=missing
 ############################ AI_TRANSLATIONS ##################################
 AI_TRANSLATIONS_API_URL = 'http://localhost:18760/api/v1'
 
+############################ CSRF ##################################
+
+# MFEs that will call this service in devstack
+CSRF_TRUSTED_ORIGINS = [
+    'http://localhost:2000',  # frontend-app-learning
+    'http://localhost:1997',  # frontend-app-account
+    'http://localhost:1995',  # frontend-app-profile
+]
+
+
 ################# New settings must go ABOVE this line #################
 ########################################################################
 # See if the developer has any local overrides.