diff --git a/src/network/CorsGate.zig b/src/network/CorsGate.zig
index 59e4af9e0..886bf4454 100644
--- a/src/network/CorsGate.zig
+++ b/src/network/CorsGate.zig
@@ -123,7 +123,6 @@ pub fn check(self: *CorsGate, transfer: *Transfer) !Result {
         }
     }
 
-    transfer._cors_cross_origin = true;
     const origin = req.origin orelse "null";
     try transfer.setHeader(ORIGIN, origin, .{});
 
@@ -136,6 +135,8 @@ pub fn check(self: *CorsGate, transfer: *Transfer) !Result {
         return .allowed;
     }
 
+    transfer._cors_cross_origin = true;
+
     if (!requiresPreflight(transfer)) {
         log.debug(.cors, "cross origin", .{
             .url = req.url,