diff --git a/upub/routes/src/lib.rs b/upub/routes/src/lib.rs
index de780cc..de5e3d7 100644
--- a/upub/routes/src/lib.rs
+++ b/upub/routes/src/lib.rs
@@ -31,7 +31,6 @@ pub async fn serve(ctx: upub::Context, bind: String) -> Result<(), std::io::Erro
 	use tower_http::{cors::CorsLayer, trace::TraceLayer};
 
 	let router = axum::Router::new()
-		.layer(CorsLayer::permissive())
 		.layer(
 			// TODO 4xx errors aren't really failures but since upub is in development it's useful to log
 			//      these too, in case something's broken
@@ -47,6 +46,7 @@ pub async fn serve(ctx: upub::Context, bind: String) -> Result<(), std::io::Erro
 		)
 		.ap_routes()
 		.mastodon_routes() // no-op if mastodon feature is disabled
+		.layer(CorsLayer::permissive())
 		.with_state(ctx);
 
 	tracing::info!("serving api routes on {bind}");