diff --git a/src/browser/Frame.zig b/src/browser/Frame.zig
index b916acb33..8939cee6c 100644
--- a/src/browser/Frame.zig
+++ b/src/browser/Frame.zig
@@ -859,6 +859,8 @@ pub fn navigate(self: *Frame, request_url: [:0]const u8, opts: NavigateOpts) !vo
         .throttle = self.parent == null,
         .origin = self.origin,
         .resource_type = .document,
+        .request_mode = .navigate,
+        .credentials_mode = .include,
         .header_callback = frameHeaderDoneCallback,
         .data_callback = frameDataCallback,
         .done_callback = frameDoneCallback,
@@ -2383,6 +2385,8 @@ pub fn loadExternalStylesheet(self: *Frame, link: *Element.Html.Link, href: []co
         .url = resolved,
         .method = .GET,
         .origin = self.origin,
+        .request_mode = .no_cors,
+        .credentials_mode = .same_origin,
         .resource_type = .stylesheet,
         .shutdown_callback = HttpClient.noopShutdown, // syncRequest installs its own
     }, &self._http_owner) catch |err| {
diff --git a/src/browser/ScriptManagerBase.zig b/src/browser/ScriptManagerBase.zig
index 1f6a8ce97..bc8e34e35 100644
--- a/src/browser/ScriptManagerBase.zig
+++ b/src/browser/ScriptManagerBase.zig
@@ -249,6 +249,9 @@ pub fn preloadImport(self: *ScriptManagerBase, url: [:0]const u8, referrer: []co
         .ctx = script,
         .url = url,
         .method = .GET,
+        .origin = owner.origin(),
+        .request_mode = .cors,
+        .credentials_mode = .same_origin,
         .resource_type = .script,
         .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
         .header_callback = Script.headerCallback,
@@ -438,6 +441,9 @@ pub fn getAsyncImport(self: *ScriptManagerBase, url: [:0]const u8, cb: ImportAsy
         .url = url,
         .method = .GET,
         .resource_type = .script,
+        .origin = owner.origin(),
+        .request_mode = .cors,
+        .credentials_mode = .same_origin,
         .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
         .header_callback = Script.headerCallback,
         .data_callback = Script.dataCallback,
diff --git a/src/browser/frame/resource_load.zig b/src/browser/frame/resource_load.zig
index 19a44cbb6..ddf60f861 100644
--- a/src/browser/frame/resource_load.zig
+++ b/src/browser/frame/resource_load.zig
@@ -80,6 +80,8 @@ pub fn image(frame: *Frame, img: *Element.Html.Image, src: []const u8) !void {
         .url = resolved,
         .method = .GET,
         .origin = frame.origin,
+        .request_mode = .no_cors,
+        .credentials_mode = .same_origin,
         .resource_type = .image,
         .headers_only = true,
         .header_callback = ImageLoad.headerCallback,
diff --git a/src/browser/webapi/SharedWorkerGlobalScope.zig b/src/browser/webapi/SharedWorkerGlobalScope.zig
index 1e640c9b5..b7f3b9cbb 100644
--- a/src/browser/webapi/SharedWorkerGlobalScope.zig
+++ b/src/browser/webapi/SharedWorkerGlobalScope.zig
@@ -106,6 +106,8 @@ pub fn init(frame: *Frame, url: [:0]const u8, name: []const u8, worker_type: Wor
         .url = owned_url,
         .resource_type = .worker,
         .origin = frame.origin,
+        .credentials_mode = .same_origin,
+        .request_mode = .same_origin,
         .header_callback = httpHeaderCallback,
         .data_callback = httpDataCallback,
         .done_callback = httpDoneCallback,
diff --git a/src/browser/webapi/Worker.zig b/src/browser/webapi/Worker.zig
index e7c0e3421..a1c5cd22f 100644
--- a/src/browser/webapi/Worker.zig
+++ b/src/browser/webapi/Worker.zig
@@ -107,6 +107,8 @@ pub fn init(url: []const u8, options: ?WorkerOptions, frame: *Frame) !*Worker {
         .loader_id = self._loader_id,
         .resource_type = if (self._type == .module) .script else .worker,
         .origin = frame.origin,
+        .request_mode = .same_origin,
+        .credentials_mode = .same_origin,
         .header_callback = httpHeaderCallback,
         .data_callback = httpDataCallback,
         .done_callback = httpDoneCallback,
diff --git a/src/browser/webapi/WorkerGlobalScope.zig b/src/browser/webapi/WorkerGlobalScope.zig
index d2199aa40..1cd27190d 100644
--- a/src/browser/webapi/WorkerGlobalScope.zig
+++ b/src/browser/webapi/WorkerGlobalScope.zig
@@ -431,6 +431,8 @@ fn importScript(self: *WorkerGlobalScope, arena: Allocator, url: [:0]const u8) !
         .method = .GET,
         .resource_type = .worker,
         .origin = self.origin,
+        .request_mode = .same_origin,
+        .credentials_mode = .same_origin,
         .shutdown_callback = HttpClient.noopShutdown, // syncRequest installs its own
     }, &self._http_owner) catch |err| {
         log.warn(.http, "importScript", .{ .url = resolved_url, .err = err });
diff --git a/src/browser/webapi/net/EventSource.zig b/src/browser/webapi/net/EventSource.zig
index a3ac7319b..61737d4a4 100644
--- a/src/browser/webapi/net/EventSource.zig
+++ b/src/browser/webapi/net/EventSource.zig
@@ -180,6 +180,8 @@ fn connect(self: *EventSource) !void {
         .method = .GET,
         .cookies = cookie_support,
         .origin = exec.origin(),
+        .request_mode = .cors,
+        .credentials_mode = if (self._with_credentials) .include else .same_origin,
         .resource_type = .eventsource,
         .streaming = true,
         .header_callback = httpHeaderDoneCallback,
diff --git a/src/browser/webapi/net/XMLHttpRequest.zig b/src/browser/webapi/net/XMLHttpRequest.zig
index df65cf72e..07e2e473b 100644
--- a/src/browser/webapi/net/XMLHttpRequest.zig
+++ b/src/browser/webapi/net/XMLHttpRequest.zig
@@ -317,6 +317,7 @@ pub fn send(self: *XMLHttpRequest, body_: ?BodyInit, exec_: *const Execution) !v
         .body = self._request_body,
         .cookies = cookie_support,
         .credentials_mode = if (self._with_credentials) .include else .same_origin,
+        .request_mode = .cors,
         .origin = exec.origin(),
         .resource_type = .xhr,
         .timeout_ms = self._timeout,
diff --git a/src/network/CorsGate.zig b/src/network/CorsGate.zig
index 910bede73..31c4b65cd 100644
--- a/src/network/CorsGate.zig
+++ b/src/network/CorsGate.zig
@@ -509,6 +509,8 @@ fn fetchThenResume(self: *CorsGate, transfer: *Transfer) !void {
         .cookie_jar = null,
         .cookie_origin = transfer.req.cookie_origin,
         .origin = transfer.req.origin,
+        .credentials_mode = .omit,
+        .request_mode = .no_cors,
         .ctx = ctx,
         .header_callback = CorsPreflightContext.headerCallback,
         .done_callback = CorsPreflightContext.doneCallback,
diff --git a/src/network/HttpClient.zig b/src/network/HttpClient.zig
index a7adf5670..4128238ed 100644
--- a/src/network/HttpClient.zig
+++ b/src/network/HttpClient.zig
@@ -1850,8 +1850,8 @@ pub const Request = struct {
     redirect: RedirectMode = .follow,
     referrer_policy: ?referrer.Policy = null,
     basic_auth_credentials: ?[:0]const u8 = null,
-    credentials_mode: CredentialsMode = .same_origin,
-    request_mode: RequestMode = .cors,
+    credentials_mode: CredentialsMode,
+    request_mode: RequestMode,
     timeout_ms: u32 = 0,
     skip_cache: bool = false,
 
diff --git a/src/network/RobotsGate.zig b/src/network/RobotsGate.zig
index 3ff2e1e23..49ba8113c 100644
--- a/src/network/RobotsGate.zig
+++ b/src/network/RobotsGate.zig
@@ -117,6 +117,8 @@ fn fetchThenResume(self: *RobotsGate, robots_url: [:0]const u8, transfer: *Trans
         .loader_id = transfer.req.loader_id,
         .notification = transfer.req.notification,
         .origin = null,
+        .credentials_mode = .omit,
+        .request_mode = .no_cors,
         .ctx = robots_ctx,
         .header_callback = RobotsContext.headerCallback,
         .data_callback = RobotsContext.dataCallback,