diff --git a/Cargo.lock b/Cargo.lock
index 8b343b9..2c50d72 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -900,11 +900,13 @@ version = "0.1.0"
 dependencies = [
  "axum",
  "dotenvy",
+ "http",
  "redis 0.25.3",
  "redis-derive",
  "reqwest",
  "serde",
  "tokio",
+ "tower-http",
  "twitch_api",
  "twitch_oauth2",
  "twitch_types",
@@ -1252,6 +1254,22 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "tower-http"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
+dependencies = [
+ "bitflags 2.5.0",
+ "bytes",
+ "http",
+ "http-body",
+ "http-body-util",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.2"
diff --git a/Cargo.toml b/Cargo.toml
index 5f54301..f2987b1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,12 +12,14 @@ redis = "0.25.3"
 redis-derive = "0.1.7"
 reqwest = "0.12.4"
 tokio = { version = "1.0.0", features = ["rt", "rt-multi-thread", "macros"] }
+tower-http = { version = "0.5.2", features = ["cors"] }
 
 # found in https://github.com/twitch-rs/twitch_api/issues/405
 twitch_api = { git = "https://github.com/twitch-rs/twitch_api/", features = ["client", "helix", "reqwest", "twitch_oauth2"] }
 twitch_oauth2 = { git = "https://github.com/twitch-rs/twitch_api/", features = ["reqwest", "client"] }
 twitch_types = { git = "https://github.com/twitch-rs/twitch_api/" }
 serde = { version = "1.0.198", features = ["derive"] }
+http = "1.1.0"
 
 # workaround for https://github.com/twitch-rs/twitch_api/issues/256
 [patch.crates-io.twitch_types]
diff --git a/src/main.rs b/src/main.rs
index e8597e6..ec8755b 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -5,6 +5,8 @@ use serde::{Deserialize, Serialize};
 use std::error::Error;
 use std::sync::Arc;
 use tokio::net::TcpListener;
+use tower_http::cors::{Any, CorsLayer};
+use http::Method;
 
 use crate::avatar_cache::AvatarCache;
 use crate::avatar_fetch::AvatarFetch;
@@ -25,6 +27,7 @@ async fn main() -> Result<(), Box<dyn Error>> {
 
     let router = Router::new()
         .route("/", get(AppRoute::root))
+        .layer(CorsLayer::new().allow_origin(Any).allow_methods([Method::GET]))
         .with_state(state);
 
     let listener = TcpListener::bind(config.app().bind_address()).await?;