diff --git a/package.json b/package.json
index f1f71cc..706ce6d 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@fortawesome/fontawesome-free": "^6.4.2",
-    "@koa/cors": "^4.0.0",
+    "@koa/cors": "^5.0.0",
     "debug": "^4.3.4",
     "js-base64": "^3.7.5",
     "koa": "^2.14.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b257679..cabe3c8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,8 +9,8 @@ dependencies:
     specifier: ^6.4.2
     version: 6.5.1
   '@koa/cors':
-    specifier: ^4.0.0
-    version: 4.0.0
+    specifier: ^5.0.0
+    version: 5.0.0
   debug:
     specifier: ^4.3.4
     version: 4.3.4
@@ -682,8 +682,8 @@ packages:
       '@jridgewell/sourcemap-codec': 1.4.15
     dev: true
 
-  /@koa/cors@4.0.0:
-    resolution: {integrity: sha512-Y4RrbvGTlAaa04DBoPBWJqDR5gPj32OOz827ULXfgB1F7piD1MB/zwn8JR2LAnvdILhxUbXbkXGWuNVsFuVFCQ==}
+  /@koa/cors@5.0.0:
+    resolution: {integrity: sha512-x/iUDjcS90W69PryLDIMgFyV21YLTnG9zOpPXS7Bkt2b8AsY3zZsIpOLBkYr9fBcF3HbkKaER5hOBZLfpLgYNw==}
     engines: {node: '>= 14.0.0'}
     dependencies:
       vary: 1.1.2
diff --git a/src/app.js b/src/app.js
index 5fa85e2..8cd3c54 100644
--- a/src/app.js
+++ b/src/app.js
@@ -9,7 +9,14 @@ const debug = createDebug('app:main');
 const pptr = createDebug('app:pptr');
 const app = new Koa();
 
-app.use(cors({ allowMethods: 'GET' }));
+app.use(
+  cors({
+    allowMethods: 'GET',
+    origin(ctx) {
+      return ctx.get('Origin') || '*';
+    },
+  })
+);
 app.use(route.get('/', views.home));
 app.use(route.get('/services/oembed', views.servicesOembed));
 app.use(route.get('/img/:encodedCode', views.img));
diff --git a/test/kitchensink.test.js b/test/kitchensink.test.js
index c4739df..75a2477 100644
--- a/test/kitchensink.test.js
+++ b/test/kitchensink.test.js
@@ -417,7 +417,8 @@ describe('app', () => {
   });
 
   describe('Fixed #272, ER diagram', () => {
-    const encodedPath = 'pako:eNpFjrEKwzAMRH_F3FjyBd4CXTt1a9VBxEpqiO3gyEMJ_ve4SaE36R6H7jYMyQksJF89T5kDRdPUPwn9hfAy2wm-WjX7OJn-JJUiOgTJgb1rH44gQd8ShGDb6WTkMiuBYm1RLprunzjAai7SoSyOVX61sCPPa6MLx0dKfy_Oa8q3c-Uxtu7OaTo4';
+    const encodedPath =
+      'pako:eNpFjrEKwzAMRH_F3FjyBd4CXTt1a9VBxEpqiO3gyEMJ_ve4SaE36R6H7jYMyQksJF89T5kDRdPUPwn9hfAy2wm-WjX7OJn-JJUiOgTJgb1rH44gQd8ShGDb6WTkMiuBYm1RLprunzjAai7SoSyOVX61sCPPa6MLx0dKfy_Oa8q3c-Uxtu7OaTo4';
 
     test('img', async () => {
       const resp = await request.get(`/img/${encodedPath}`);