diff --git a/image_server/Dockerfile b/image_server/Dockerfile
index 9fd3e8a..47f75f0 100644
--- a/image_server/Dockerfile
+++ b/image_server/Dockerfile
@@ -82,7 +82,6 @@ RUN chown -R root:apprun /var/www/iipsrv/cgi-bin/* && chmod 774 /var/www/iipsrv/
 # ---- For split packages, cut here ----
 
 ENV ALLOW_UPSCALING 0
-ENV CORS "*"
 ENV LOGFILE "/dev/stdout"
 ENV URI_MAP "iiif=>IIIF"
 ENV MAX_IMAGE_CACHE_SIZE "0"
diff --git a/image_server/nginx.conf b/image_server/nginx.conf
index ed8f6ce..7321a6d 100644
--- a/image_server/nginx.conf
+++ b/image_server/nginx.conf
@@ -25,8 +25,6 @@ http {
 
         include /etc/nginx/fastcgi_params;
 
-        add_header 'Access-Control-Allow-Origin' '*';
-
         location / {
             fastcgi_pass    localhost:9000;
             fastcgi_param   PATH_INFO $fastcgi_script_name;
@@ -37,6 +35,8 @@ http {
             fastcgi_param   SERVER_PROTOCOL $server_protocol;
             fastcgi_param   REQUEST_URI $request_uri;
             fastcgi_param   HTTPS $https if_not_empty;
+            proxy_hide_header Access-Control-Allow-Origin;
+            add_header Access-Control-Allow-Origin '*';
         }
     }