diff --git a/etc-docker/nginx.conf b/etc-docker/nginx.conf
index 9ecea851..f1194471 100644
--- a/etc-docker/nginx.conf
+++ b/etc-docker/nginx.conf
@@ -27,13 +27,14 @@ http {
         listen      80;
         server_name 0.0.0.0;
 
-        location * {
-            add_header Access-Control-Allow-Origin *;
-        }
-
         location / {
             add_header Cache-Control must-revalidate;
             add_header Cache-Control public;
+            # Mirrors the CORS middleware in app/stubs/server.ts so the
+            # frontend can fetch static files (changes.txt, server_overview.json, ...)
+            # from a localhost dev server without hitting CORS restrictions.
+            add_header Access-Control-Allow-Origin *;
+            add_header Access-Control-Allow-Headers 'content-type,x-requested-with';
             root   /home/lacuna/server/var/www/public;
             # For debugging:
             add_header X-URI $uri always;