diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4175443..aa7c53f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@
 * Simplified documentation for S3 setup and alias domains
 * Fix CORS responses for auth subdomains and forward real client IPs from Cloudron proxy
 * Remove unsupported Caddy `trusted_proxies` stanza while continuing to trust Cloudron-provided `X-Forwarded-For` headers for accurate logging
+* Set CORS headers via reverse proxy response rewrites so cross-subdomain logins work reliably
 
 ## 0.4.4 (2025-10-30)
 
diff --git a/start.sh b/start.sh
index f3dfc4f..b6d28de 100755
--- a/start.sh
+++ b/start.sh
@@ -565,23 +565,20 @@ cat > "$CADDY_CONFIG" <<EOF_CADDY
     }
 
     handle_path /api/* {
-        reverse_proxy localhost:8080 {
-            header_up Host {http.request.host}
-            header_up X-Real-IP {http.request.header.X-Forwarded-For}
-            header_up X-Forwarded-For {http.request.header.X-Forwarded-For}
-            header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
-        }
-        @api_cors {
-            header Origin *
-        }
-        header -Access-Control-Allow-Origin
-        header -Access-Control-Allow-Credentials
-        header @api_cors {
+        @api_cors_subdomain header Origin *
+        header @api_cors_subdomain {
             Access-Control-Allow-Origin {http.request.header.Origin}
             Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
             Access-Control-Allow-Headers "*"
             Access-Control-Allow-Credentials "true"
             Vary "Origin"
+            defer
+        }
+        reverse_proxy localhost:8080 {
+            header_up Host {http.request.host}
+            header_up X-Real-IP {http.request.header.X-Forwarded-For}
+            header_up X-Forwarded-For {http.request.header.X-Forwarded-For}
+            header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
         }
     }
 
@@ -685,23 +682,20 @@ cat > "$CADDY_CONFIG" <<EOF_CADDY
     }
 
     handle_path /api/* {
-        reverse_proxy localhost:8080 {
-            header_up Host {http.request.host}
-            header_up X-Real-IP {http.request.header.X-Forwarded-For}
-            header_up X-Forwarded-For {http.request.header.X-Forwarded-For}
-            header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
-        }
-        @api_cors {
-            header Origin *
-        }
-        header -Access-Control-Allow-Origin
-        header -Access-Control-Allow-Credentials
-        header @api_cors {
+        @api_cors_path header Origin *
+        header @api_cors_path {
             Access-Control-Allow-Origin {http.request.header.Origin}
             Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
             Access-Control-Allow-Headers "*"
             Access-Control-Allow-Credentials "true"
             Vary "Origin"
+            defer
+        }
+        reverse_proxy localhost:8080 {
+            header_up Host {http.request.host}
+            header_up X-Real-IP {http.request.header.X-Forwarded-For}
+            header_up X-Forwarded-For {http.request.header.X-Forwarded-For}
+            header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
         }
     }