diff --git a/CLAUDE.md b/CLAUDE.md
index 56244a4..a2d1382 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,5 +1,24 @@
 # CLAUDE.md - alist API 프로젝트
 
+## Claude 작업 규칙 (중요!)
+
+### 코드 수정 시 반드시 따를 것
+1. **절대로 바로 파일을 수정하지 말 것**
+2. **먼저 수정 방향과 계획을 설명**
+3. **수정할 코드를 먼저 보여주기** (사용자가 직접 수정할 수도 있도록)
+4. **사용자 확인 후 자동 작성 진행** 또는 사용자가 요청 시에만 작성
+
+### 작업 순서 예시
+```
+1. "CORS 설정을 yml로 분리하겠습니다."
+2. "다음과 같이 수정됩니다:"
+   - CorsProperties.java 생성 (코드 보여주기)
+   - CorsConfig.java 수정 (코드 보여주기)
+   - application-local.yaml 수정 (코드 보여주기)
+3. "직접 수정하시겠습니까? 아니면 제가 작성할까요?"
+4. (사용자 확인 후) 파일 수정 진행
+```
+
 ## 프로젝트 개요
 - **프로젝트명**: alist API
 - **그룹**: com.alist
diff --git a/src/main/java/com/alist/api/config/CorsConfig.java b/src/main/java/com/alist/api/config/CorsConfig.java
index 0795186..dd08e33 100644
--- a/src/main/java/com/alist/api/config/CorsConfig.java
+++ b/src/main/java/com/alist/api/config/CorsConfig.java
@@ -1,41 +1,31 @@
 package com.alist.api.config;
 
+import com.alist.api.config.properties.CorsProperties;
+import lombok.RequiredArgsConstructor;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
-import java.util.Arrays;
-
 @Configuration
+@EnableConfigurationProperties(CorsProperties.class)
+@RequiredArgsConstructor
 public class CorsConfig {
 
+    private final CorsProperties corsProperties;
+
     @Bean
     public CorsConfigurationSource corsConfigurationSource() {
         CorsConfiguration configuration = new CorsConfiguration();
 
-        configuration.setAllowedOrigins(Arrays.asList(
-                "http://localhost",
-                "http://localhost:8100",
-                "http://localhost:8101",
-                "http://localhost:8102",
-                "http://localhost:8103",
-                "http://localhost:8104",
-                "http://localhost:8105",
-                "https://wwwl-alist.pjt.kr",
-                "https://engl-alist.pjt.kr",
-                "https://admin-alist.pjt.kr",
-                "https://wwwc-alist.pjt.kr",
-                "https://class-alist.pjt.kr",
-                "https://student-alist.pjt.kr"
-        ));
-
-        configuration.setAllowCredentials(true);
-        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"));
-        configuration.setAllowedHeaders(Arrays.asList("*"));
-        configuration.setExposedHeaders(Arrays.asList("Authorization", "Set-Cookie"));
-        configuration.setMaxAge(3600L);
+        configuration.setAllowedOrigins(corsProperties.getAllowedOrigins());
+        configuration.setAllowCredentials(corsProperties.getAllowCredentials());
+        configuration.setAllowedMethods(corsProperties.getAllowedMethods());
+        configuration.setAllowedHeaders(corsProperties.getAllowedHeaders());
+        configuration.setExposedHeaders(corsProperties.getExposedHeaders());
+        configuration.setMaxAge(corsProperties.getMaxAge());
 
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
         source.registerCorsConfiguration("/**", configuration);
diff --git a/src/main/java/com/alist/api/config/properties/CorsProperties.java b/src/main/java/com/alist/api/config/properties/CorsProperties.java
new file mode 100644
index 0000000..41050f5
--- /dev/null
+++ b/src/main/java/com/alist/api/config/properties/CorsProperties.java
@@ -0,0 +1,19 @@
+package com.alist.api.config.properties;
+
+import lombok.Getter;
+import lombok.Setter;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+import java.util.List;
+
+@Getter
+@Setter
+@ConfigurationProperties(prefix = "cors")
+public class CorsProperties {
+	List<String> allowedOrigins;
+	Boolean allowCredentials = true;
+	List<String> allowedMethods = List.of("GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS");
+	List<String> allowedHeaders = List.of("*");
+	List<String> exposedHeaders = List.of("Authorization", "Set-Cookie");
+	Long maxAge = 3600L;
+}
diff --git a/src/main/resources/application-local.yaml b/src/main/resources/application-local.yaml
index c2f10e5..d1ceba5 100644
--- a/src/main/resources/application-local.yaml
+++ b/src/main/resources/application-local.yaml
@@ -18,6 +18,16 @@ jwt:
 cookie:
   secure: false  # 로컬 개발 환경 (HTTP)
 
+cors:
+  allowed-origins:
+    - "http://localhost:8100"
+    - "http://localhost:8101"
+    - "http://localhost:8102"
+    - "http://localhost:8103"
+    - "http://localhost:8104"
+    - "http://localhost:8105"
+    - "http://localhost:8108"
+
 swagger:
   login:
     id: alist
diff --git a/src/main/resources/application-pjt.yaml b/src/main/resources/application-pjt.yaml
index 31aa0a8..004fe5d 100644
--- a/src/main/resources/application-pjt.yaml
+++ b/src/main/resources/application-pjt.yaml
@@ -20,6 +20,24 @@ jwt:
 cookie:
   secure: true  # 프로젝트 환경 (HTTPS)
 
+cors:
+  allowed-origins:
+    - "http://localhost"
+    - "http://localhost:8100"
+    - "http://localhost:8101"
+    - "http://localhost:8102"
+    - "http://localhost:8103"
+    - "http://localhost:8104"
+    - "http://localhost:8105"
+    - "http://localhost:8108"
+    - "https://wwwl-alist.pjt.kr"
+    - "https://engl-alist.pjt.kr"
+    - "https://admin-alist.pjt.kr"
+    - "https://wwwc-alist.pjt.kr"
+    - "https://class-alist.pjt.kr"
+    - "https://student-alist.pjt.kr"
+    - "https://storybook-alist.pjt.kr"
+
 swagger:
   login:
     id: ${SWAGGER_ID}