diff --git a/cluster/prod/app/cryptpad/deploy/cryptpad-debug.hcl b/cluster/prod/app/cryptpad/deploy/cryptpad-debug.hcl
index f0451d4..19fceae 100644
--- a/cluster/prod/app/cryptpad/deploy/cryptpad-debug.hcl
+++ b/cluster/prod/app/cryptpad/deploy/cryptpad-debug.hcl
@@ -63,6 +63,8 @@ job "cryptpad-debug" {
           "tricot pad-sandbox-debug.deuxfleurs.fr",
           "tricot-add-header Cross-Origin-Resource-Policy cross-origin",
           "tricot-add-header Cross-Origin-Embedder-Policy require-corp",
+          "tricot-add-header Access-Control-Allow-Origin https://pad-sandbox-debug.deuxfleurs.fr",
+          "tricot-add-header Access-Control-Allow-Credentials true",
           "d53-cname pad-debug.deuxfleurs.fr",
           "d53-cname pad-sandbox-debug.deuxfleurs.fr",
         ]
diff --git a/cluster/prod/app/cryptpad/deploy/cryptpad.hcl b/cluster/prod/app/cryptpad/deploy/cryptpad.hcl
index 048345d..ce6a414 100644
--- a/cluster/prod/app/cryptpad/deploy/cryptpad.hcl
+++ b/cluster/prod/app/cryptpad/deploy/cryptpad.hcl
@@ -63,6 +63,8 @@ job "cryptpad" {
           "tricot pad-sandbox.deuxfleurs.fr",
           "tricot-add-header Cross-Origin-Resource-Policy cross-origin",
           "tricot-add-header Cross-Origin-Embedder-Policy require-corp",
+          "tricot-add-header Access-Control-Allow-Origin https://pad-sandbox.deuxfleurs.fr",
+          "tricot-add-header Access-Control-Allow-Credentials true",
           "d53-cname pad.deuxfleurs.fr",
           "d53-cname pad-sandbox.deuxfleurs.fr",
         ]