diff --git a/upub/routes/src/lib.rs b/upub/routes/src/lib.rs
index d99081c3..de780ccb 100644
--- a/upub/routes/src/lib.rs
+++ b/upub/routes/src/lib.rs
@@ -31,6 +31,7 @@ pub async fn serve(ctx: upub::Context, bind: String) -> Result<(), std::io::Erro
 	use tower_http::{cors::CorsLayer, trace::TraceLayer};
 
 	let router = axum::Router::new()
+		.layer(CorsLayer::permissive())
 		.layer(
 			// TODO 4xx errors aren't really failures but since upub is in development it's useful to log
 			//      these too, in case something's broken
@@ -44,7 +45,6 @@ pub async fn serve(ctx: upub::Context, bind: String) -> Result<(), std::io::Erro
 					)
 				})
 		)
-		.layer(CorsLayer::permissive())
 		.ap_routes()
 		.mastodon_routes() // no-op if mastodon feature is disabled
 		.with_state(ctx);