diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 675be356c0..b4216b51c4 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -30304,7 +30304,7 @@ components:
           items:
             type: string
             maxLength: 256
-          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list allows no origin at all, blocking every browser while leaving non-browser clients unaffected. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset."
+          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset."
         error_handler_path:
           type: string
           description: Path to a script to run when the triggered job fails. A bare
@@ -30403,7 +30403,7 @@ components:
           items:
             type: string
             maxLength: 256
-          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list allows no origin at all, blocking every browser while leaving non-browser clients unaffected. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset."
+          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset."
         error_handler_path:
           type: string
           description: Path to a script to run when the triggered job fails. A bare
@@ -30509,7 +30509,7 @@ components:
           items:
             type: string
             maxLength: 256
-          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list allows no origin at all, blocking every browser while leaving non-browser clients unaffected. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset."
+          description: "Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset."
         error_handler_path:
           type: string
           description: Path to a script to run when the triggered job fails. A bare
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 26623e71b3..a95fc8df1b 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -8394,9 +8394,8 @@ properties:
       set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin
       the runnable returns via wm_headers. Use [''*''] to opt out of any restriction,
       including the http_route_default_allowed_origins instance setting. An empty
-      list allows no origin at all, blocking every browser while leaving non-browser
-      clients unaffected. When null, the instance setting applies, or Access-Control-Allow-Origin:
-      * if it is unset.'
+      list is not a configuration and resolves exactly as null does. When null, the
+      instance setting applies, or Access-Control-Allow-Origin: * if it is unset.'
   error_handler_path:
     type: string
     description: Path to a script to run when the triggered job fails. A bare path,
diff --git a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
index 058362ebac..c6db05611e 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
@@ -69,7 +69,7 @@ export const httpTriggerRequestSchema = z.object({
 	"wrap_body": z.boolean().describe("If true, wraps the request body in a 'body' parameter").optional(),
 	"mode": z.enum(["enabled", "disabled", "suspended"]).describe("job trigger mode").optional(),
 	"raw_string": z.boolean().describe("If true, passes the request body as a raw string instead of parsing as JSON").optional(),
-	"allowed_origins": z.array(z.string()).describe("Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list allows no origin at all, blocking every browser while leaving non-browser clients unaffected. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset.").nullable().optional(),
+	"allowed_origins": z.array(z.string()).describe("Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset.").nullable().optional(),
 	"error_handler_path": z.string().describe("Path to a script to run when the triggered job fails. A bare path, without the script/ or flow/ prefix a schedule error handler takes; it cannot be a flow.").optional(),
 	"error_handler_args": z.record(z.string(), z.any()).describe("Arguments to pass to the error handler").optional(),
 	"retry": z.object({
diff --git a/system_prompts/auto-generated/schemas/http_trigger.schema.yaml b/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
index 82f0144acb..c5e634da07 100644
--- a/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
+++ b/system_prompts/auto-generated/schemas/http_trigger.schema.yaml
@@ -104,9 +104,8 @@ properties:
       set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin
       the runnable returns via wm_headers. Use [''*''] to opt out of any restriction,
       including the http_route_default_allowed_origins instance setting. An empty
-      list allows no origin at all, blocking every browser while leaving non-browser
-      clients unaffected. When null, the instance setting applies, or Access-Control-Allow-Origin:
-      * if it is unset.'
+      list is not a configuration and resolves exactly as null does. When null, the
+      instance setting applies, or Access-Control-Allow-Origin: * if it is unset.'
   error_handler_path:
     type: string
     description: Path to a script to run when the triggered job fails. A bare path,