diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f79bcad..7b9d807f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,10 +7,13 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 ### Added
 ### Removed
 ### Changed
+### Fixed
+
+## 2024-04-09: v0.16.0-dev.2
+### Changed
 - Upgrade to latest JS client.
   - Set allowed origins for admin websockets in Tryorama conductors and when attaching app websockets.
   - Pass origin when connecting admin and app websockets.
-### Fixed
 
 ## 2024-02-28: v0.16.0-dev.1
 ### Changed
diff --git a/docs/tryorama.allowed_origin.md b/docs/tryorama.allowed_origin.md
deleted file mode 100644
index fb1cbddc..00000000
--- a/docs/tryorama.allowed_origin.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- Do not edit this file. It is automatically generated by API Documenter. -->
-
-[Home](./index.md) &gt; [@holochain/tryorama](./tryorama.md) &gt; [ALLOWED\_ORIGIN](./tryorama.allowed_origin.md)
-
-## ALLOWED\_ORIGIN variable
-
-**Signature:**
-
-```typescript
-ALLOWED_ORIGIN = "tryorama-interface"
-```
diff --git a/docs/tryorama.md b/docs/tryorama.md
index 1be2e403..a69ac269 100644
--- a/docs/tryorama.md
+++ b/docs/tryorama.md
@@ -984,15 +984,6 @@ Description
 </th></tr></thead>
 <tbody><tr><td>
 
-[ALLOWED\_ORIGIN](./tryorama.allowed_origin.md)
-
-
-</td><td>
-
-
-</td></tr>
-<tr><td>
-
 [DEFAULT\_PARTIAL\_PLAYER\_CONFIG](./tryorama.default_partial_player_config.md)
 
 
diff --git a/package-lock.json b/package-lock.json
index 812a6761..29e29f71 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@holochain/tryorama",
-  "version": "0.16.0-dev.1",
+  "version": "0.16.0-dev.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@holochain/tryorama",
-      "version": "0.16.0-dev.1",
+      "version": "0.16.0-dev.2",
       "license": "MIT",
       "dependencies": {
         "@holochain/client": "^0.17.0-dev.8",
diff --git a/package.json b/package.json
index c064fc90..b0a5362d 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@holochain/tryorama",
   "description": "Toolset to manage Holochain conductors and facilitate running test scenarios",
-  "version": "0.16.0-dev.1",
+  "version": "0.16.0-dev.2",
   "author": "Holochain Foundation",
   "license": "MIT",
   "keywords": [
diff --git a/ts/src/common.ts b/ts/src/common.ts
index e6a283fd..84737084 100644
--- a/ts/src/common.ts
+++ b/ts/src/common.ts
@@ -20,7 +20,10 @@ import {
 
 const BOOTSTRAP_SERVER_STARTUP_STRING = "HC BOOTSTRAP - ADDR: ";
 const SIGNALING_SERVER_STARTUP_STRING = "HC SIGNAL - ADDR: ";
-export const ALLOWED_ORIGIN = "tryorama-interface";
+/**
+ * @internal
+ */
+export const _ALLOWED_ORIGIN = "tryorama-interface";
 
 /**
  * Spawn a signalling server to enable connections between conductors.
diff --git a/ts/src/local/conductor.ts b/ts/src/local/conductor.ts
index 5078fb36..c8895604 100644
--- a/ts/src/local/conductor.ts
+++ b/ts/src/local/conductor.ts
@@ -20,7 +20,7 @@ import { v4 as uuidv4 } from "uuid";
 
 import { makeLogger } from "../logger.js";
 import { AgentsAppsOptions, AppOptions, IConductor } from "../types.js";
-import { ALLOWED_ORIGIN } from "../common.js";
+import { _ALLOWED_ORIGIN } from "../common.js";
 
 const logger = makeLogger("Local Conductor");
 
@@ -276,7 +276,7 @@ export class Conductor implements IConductor {
   private async connectAdminWs() {
     this._adminWs = await AdminWebsocket.connect({
       url: this.adminApiUrl,
-      wsClientOptions: { origin: ALLOWED_ORIGIN },
+      wsClientOptions: { origin: _ALLOWED_ORIGIN },
       defaultTimeout: this.timeout,
     });
     logger.debug(`connected to Admin API @ ${this.adminApiUrl.href}\n`);
@@ -291,7 +291,7 @@ export class Conductor implements IConductor {
   async attachAppInterface(request?: AttachAppInterfaceRequest) {
     request = request ?? {
       port: await getPort({ port: portNumbers(30000, 40000) }),
-      allowed_origins: ALLOWED_ORIGIN,
+      allowed_origins: _ALLOWED_ORIGIN,
     };
     logger.debug(`attaching App API to port ${request.port}\n`);
     const { port } = await this.adminWs().attachAppInterface(request);
@@ -310,7 +310,7 @@ export class Conductor implements IConductor {
     appApiUrl.port = port.toString();
     const appWs = await AppWebsocket.connect({
       url: appApiUrl,
-      wsClientOptions: { origin: ALLOWED_ORIGIN },
+      wsClientOptions: { origin: _ALLOWED_ORIGIN },
       defaultTimeout: this.timeout,
     });
 
@@ -342,7 +342,7 @@ export class Conductor implements IConductor {
     appApiUrl.port = port.toString();
     const appAgentWs = await AppAgentWebsocket.connect(appId, {
       url: appApiUrl,
-      wsClientOptions: { origin: ALLOWED_ORIGIN },
+      wsClientOptions: { origin: _ALLOWED_ORIGIN },
       defaultTimeout: this.timeout,
     });
 
diff --git a/ts/src/trycp/conductor/conductor.ts b/ts/src/trycp/conductor/conductor.ts
index 5df1708f..e9bea54b 100644
--- a/ts/src/trycp/conductor/conductor.ts
+++ b/ts/src/trycp/conductor/conductor.ts
@@ -84,7 +84,7 @@ import {
   TRYCP_SUCCESS_RESPONSE,
 } from "../types.js";
 import { deserializeZomeResponsePayload } from "../util.js";
-import { ALLOWED_ORIGIN } from "../../common.js";
+import { _ALLOWED_ORIGIN } from "../../common.js";
 
 const logger = makeLogger("TryCP conductor");
 const HOLO_SIGNALING_SERVER = new URL("wss://signal.holo.host");
@@ -555,7 +555,7 @@ export class TryCpConductor implements IConductor {
      */
     const attachAppInterface = async (request?: AttachAppInterfaceRequest) => {
       request = {
-        allowed_origins: request?.allowed_origins ?? ALLOWED_ORIGIN,
+        allowed_origins: request?.allowed_origins ?? _ALLOWED_ORIGIN,
         port:
           request?.port ?? (await getPort({ port: portNumbers(30000, 40000) })),
       };