diff --git a/server.js b/server.js
index 93dd02e..5ca72d4 100644
--- a/server.js
+++ b/server.js
@@ -64,7 +64,9 @@ if (IS_PROD && allowedOrigins.length === 0) {
   console.error('[FATAL] Production mode but no APP_URL or CORS_ORIGINS set. Refusing to run with open CORS.');
   process.exit(1);
 }
-app.use(cors({
+// Scoped to /api only — static assets (including type="module" scripts which
+// always send an Origin header) must not be subject to CORS checks.
+app.use('/api', cors({
   origin: function(origin, callback) {
     // Allow requests with no origin (mobile apps, curl, server-to-server)
     if (!origin) return callback(null, true);