diff --git a/cms/envs/production.py b/cms/envs/production.py
index 36916f1e6a7..591da7658cd 100644
--- a/cms/envs/production.py
+++ b/cms/envs/production.py
@@ -192,9 +192,9 @@ def get_env_setting(setting):
 SITE_NAME = ENV_TOKENS['SITE_NAME']
 
 ALLOWED_HOSTS = [
-    # TODO: bbeggs remove this before prod, temp fix to get load testing running
-    "*",
-    CMS_BASE,
+    ENV_TOKENS.get('LMS_BASE', ''),
+    ENV_TOKENS.get('CMS_BASE', ''),
+    FEATURES.get('PREVIEW_LMS_BASE', '')
 ]
 
 LOG_DIR = ENV_TOKENS['LOG_DIR']
diff --git a/lms/envs/production.py b/lms/envs/production.py
index 2961092d3a1..fb77cbb36be 100644
--- a/lms/envs/production.py
+++ b/lms/envs/production.py
@@ -211,10 +211,9 @@ def get_env_setting(setting):
 CMS_BASE = ENV_TOKENS.get('CMS_BASE', 'studio.edx.org')
 
 ALLOWED_HOSTS = [
-    # TODO: bbeggs remove this before prod, temp fix to get load testing running
-    "*",
-    ENV_TOKENS.get('LMS_BASE'),
-    FEATURES['PREVIEW_LMS_BASE'],
+    ENV_TOKENS.get('LMS_BASE', ''),
+    ENV_TOKENS.get('CMS_BASE', ''),
+    FEATURES.get('PREVIEW_LMS_BASE', '')
 ]
 
 # allow for environments to specify what cookie name our login subsystem should use
diff --git a/openedx/core/djangoapps/appsembler/sites/apps.py b/openedx/core/djangoapps/appsembler/sites/apps.py
index 90e791c716c..09f4118b7c8 100644
--- a/openedx/core/djangoapps/appsembler/sites/apps.py
+++ b/openedx/core/djangoapps/appsembler/sites/apps.py
@@ -10,8 +10,22 @@ class SitesConfig(AppConfig):
     def ready(self):
         from openedx.core.djangoapps.appsembler.sites.models import patched_clear_site_cache
         from openedx.core.djangoapps.site_configuration.models import SiteConfiguration
+        from django.contrib.sites.models import Site
+        from django.conf import settings
+        from django.core.exceptions import ObjectDoesNotExist
 
         from .config_values_modifier import init_configuration_modifier_for_site_config
 
         pre_save.connect(patched_clear_site_cache, sender=SiteConfiguration)
         post_init.connect(init_configuration_modifier_for_site_config, sender=SiteConfiguration)
+        # Update ALLOWED_HOSTS based on Site model
+        site_domains = []
+        sites = Site.objects.all()
+        for site in sites:
+            site_domains.append(site.domain)
+            try:
+                alt_domain = site.alternative_domain
+                site_domains.append(alt_domain)
+            except ObjectDoesNotExist:
+                continue
+        settings.ALLOWED_HOSTS.extend(site_domains)