diff --git a/pkg/op/op.go b/pkg/op/op.go
index 732a933..a6561dd 100644
--- a/pkg/op/op.go
+++ b/pkg/op/op.go
@@ -35,12 +35,16 @@ var DefaultInterceptor = func(h http.HandlerFunc) http.HandlerFunc {
 	})
 }
 
+var allowAllOrigins = func(_ string) bool {
+	return true
+}
+
 func CreateRouter(o OpenIDProvider, h HttpInterceptor) *mux.Router {
 	if h == nil {
 		h = DefaultInterceptor
 	}
 	router := mux.NewRouter()
-	router.Use(handlers.CORS())
+	router.Use(handlers.CORS(handlers.AllowedOriginValidator(allowAllOrigins)))
 	router.HandleFunc(healthzEndpoint, Healthz)
 	router.HandleFunc(readinessEndpoint, o.HandleReady)
 	router.HandleFunc(oidc.DiscoveryEndpoint, o.HandleDiscovery)