diff --git a/.github/workflows/e2e-integration-test.yml b/.github/workflows/e2e-integration-test.yml
index 5a52a23cd..8999ce2ee 100644
--- a/.github/workflows/e2e-integration-test.yml
+++ b/.github/workflows/e2e-integration-test.yml
@@ -69,7 +69,7 @@ jobs:
       - name: run end to end integration tests
         continue-on-error: true
         run: |
-          ./lightpanda serve --http-cache-dir /tmp/lp-cache --http-proxy ${{ secrets.MASSIVE_PROXY_RESIDENTIAL_US }} --log-level error & echo $! > LPD.pid
+          ./lightpanda serve --experimental-features cors --http-cache-dir /tmp/lp-cache --http-proxy ${{ secrets.MASSIVE_PROXY_RESIDENTIAL_US }} --log-level error & echo $! > LPD.pid
           go run integration/main.go |tee result.log
           kill `cat LPD.pid`
 
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 5701d1706..e0d044f1c 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -117,7 +117,7 @@ jobs:
           echo "value=$args" >> "$GITHUB_OUTPUT"
 
       - run: |
-          ./lightpanda serve --port 9222 ${{ steps.args.outputs.value }} &
+          ./lightpanda serve --experimental-features cors --port 9222 ${{ steps.args.outputs.value }} &
 
       - run: |
           go run runner/main.go
@@ -163,7 +163,7 @@ jobs:
       - id: args
         name: build LP args
         run: |
-          args="--http-cache-dir /tmp/lp-cache --load-resources worker --load-resources iframe"
+          args="--experimental-features cors --http-cache-dir /tmp/lp-cache --load-resources worker --load-resources iframe"
           args="$args --protocol cdp --protocol webdriver"
           [ "${{ matrix.robotstxt }}" = "true" ] && args="$args --obey-robots"
           [ "${{ matrix.wba }}" = "true" ] && args="$args --web-bot-auth-key-file private_key.pem"
@@ -227,6 +227,7 @@ jobs:
           exec 3<<< "${{ secrets.WBA_PRIVATE_KEY_PEM }}"
 
           ./lightpanda fetch --dump http://127.0.0.1:8989/ \
+            --experimental-features cors \
             --web-bot-auth-key-file /proc/self/fd/3 \
             --web-bot-auth-keyid ${{ vars.WBA_KEY_ID }} \
             --web-bot-auth-domain ${{ vars.WBA_DOMAIN }}
@@ -250,6 +251,7 @@ jobs:
           exec 3<<< "${{ secrets.WBA_PRIVATE_KEY_PEM }}"
 
           ./lightpanda fetch --dump "http://127.0.0.1:8989/redirect?to=http://127.0.0.1:8990/" \
+            --experimental-features cors \
             --web-bot-auth-key-file /proc/self/fd/3 \
             --web-bot-auth-keyid ${{ vars.WBA_KEY_ID }} \
             --web-bot-auth-domain ${{ vars.WBA_DOMAIN }}
@@ -426,7 +428,7 @@ jobs:
 
       - run: chmod a+x ./lightpanda
 
-      - run: ./lightpanda fetch https://demo-browser.lightpanda.io/campfire-commerce/
+      - run: ./lightpanda fetch --experimental-features cors  "https://demo-browser.lightpanda.io/campfire-commerce/"
 
   agent-deterministic:
     name: agent deterministic replay
@@ -479,7 +481,7 @@ jobs:
 
           jq --version
 
-          timeout 30 ./lightpanda mcp > mcp.out <<'JSONRPC'
+          timeout 30 ./lightpanda mcp --experimental-features cors > mcp.out <<'JSONRPC'
           {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"ci","version":"1.0.0"}}}
           {"jsonrpc":"2.0","method":"notifications/initialized"}
           {"jsonrpc":"2.0","id":2,"method":"tools/list"}