diff --git a/CLAUDE.md b/CLAUDE.md
index 0827b6b..58225fb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -107,7 +107,11 @@ expect Nix to report the correct hash on a failed build (or use `nix-prefetch`/`
     It's added to `environment.systemPackages`, so it's the normal way to run artisan commands
     (`migrate`, `queue:work`, `ninja:create-account`, etc.) by hand on a deployed system.
   - Both `nginx` and `caddy` proxy backends are supported (`proxy.server`), each independently duplicating the
-    CORS headers and PHP-FPM passthrough config — if changing one, check whether the other needs the same change.
+    PHP-FPM passthrough config — if changing one, check whether the other needs the same change. Neither sets
+    CORS headers itself: Laravel's own CORS middleware already sends a complete set on every response, and an
+    earlier version of this module additionally set a second, static set of `Access-Control-*` headers at the
+    proxy level, which browsers reject as conflicting duplicates (server-to-server/curl checks don't notice,
+    since only browsers enforce CORS header validation).
   - Chromium is required at runtime for PDF generation (`PDF_GENERATOR=snappdf`, `SNAPPDF_CHROMIUM_PATH`) and is
     added to the PHP-FPM and data-setup services' `path`.
 
diff --git a/nixos-module/invoiceninja.nix b/nixos-module/invoiceninja.nix
index a2c0584..697b68b 100644
--- a/nixos-module/invoiceninja.nix
+++ b/nixos-module/invoiceninja.nix
@@ -526,14 +526,6 @@ in
             if (!-e $request_filename) {
               rewrite ^(.+)$ /index.php?q= last;
             }
-
-            add_header 'Access-Control-Allow-Origin' '*';
-            add_header 'Access-Control-Allow-Methods' '*';
-            add_header 'Access-Control-Max-Age' 0;
-            add_header 'Content-Length' 0;
-            add_header 'Access-Control-Allow-Headers' 'X-API-COMPANY-KEY,X-API-SECRET,X-API-TOKEN,X-API-PASSWORD,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Disposition,Content-Type,Range,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE';
-            add_header 'Access-Control-Expose-Headers' 'X-APP-VERSION,X-MINIMUM-CLIENT-VERSION,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE';
-            add_header 'Access-Control-Allow-Credentials' false;
           '';
         }
         (lib.mkIf (cfg.hostname != "localhost") {
@@ -569,14 +561,6 @@ in
               encode zstd gzip
               root ${invoiceninja}/public
               php_fastcgi unix/${config.services.phpfpm.pools.invoiceninja.socket}
-              header {
-                Access-Control-Allow-Origin "*"
-                Access-Control-Allow-Methods "*"
-                Access-Control-Max-Age "0"
-                Access-Control-Allow-Headers "X-API-COMPANY-KEY,X-API-SECRET,X-API-TOKEN,X-API-PASSWORD,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Disposition,Content-Type,Range,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE"
-                Access-Control-Expose-Headers "X-APP-VERSION,X-MINIMUM-CLIENT-VERSION,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE"
-                Access-Control-Allow-Credentials false
-              }
               file_server
             '';
           }