diff --git a/src/widget.ts b/src/widget.ts
index 4c4e9d1d..2511376a 100644
--- a/src/widget.ts
+++ b/src/widget.ts
@@ -93,6 +93,16 @@ export const initializeWidget = (
       const parentOrigin = new URL(parentUrl).origin;
       logger.info("Widget API is available");
       const api = new WidgetApi(widgetId, parentOrigin);
+      // [lotus] matrix-widget-api's PostmessageTransport defaults
+      // strictOriginCheck to false, which would let any frame holding a
+      // handle to our window post toWidget actions (including the
+      // io.lotus.* actions below). The Lotus deployment serves EC
+      // same-origin with the host (cinny loads /public/element-call/index.html),
+      // so globalThis.origin === parentOrigin and this check passes safely.
+      // A cross-origin deployment would need to compare ev.origin to
+      // parentOrigin instead, since strictOriginCheck compares against
+      // globalThis.origin.
+      api.transport.strictOriginCheck = true;
       api.requestCapability(MatrixCapabilities.AlwaysOnScreen);
       api.requestCapability(MatrixCapabilities.MSC4039DownloadFile);