diff --git a/apps/audiobookshelf/ingress.yaml b/apps/audiobookshelf/ingress.yaml
index 8419a4b..edd5d9a 100644
--- a/apps/audiobookshelf/ingress.yaml
+++ b/apps/audiobookshelf/ingress.yaml
@@ -9,9 +9,29 @@ spec:
   routes:
   - match: Host(`audiobookshelf.kluster.moll.re`)
     kind: Rule
+    middlewares:
+    - name: audiobookshelf
     services:
     - name: audiobookshelf-web
       port: 80
 
   tls:
-    certResolver: default-tls 
+    certResolver: default-tls
+
+---
+
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: audiobookshelf
+spec:
+  headers:
+    accessControlAllowOriginList:
+      - "*"
+    accessControlAllowCredentials: true
+    accessControlAllowHeaders: [ "Authorization","Content-Type" ] # "Accept","Origin"
+    accessControlAllowMethods: [ "GET","HEAD","OPTIONS" ] # "POST","PUT"
+    accessControlMaxAge: 100
+    customRequestHeaders:
+      Connection: keep-alive, Upgrade
+      Upgrade: "websocket"
diff --git a/apps/kitchenowl/ingress.yaml b/apps/kitchenowl/ingress.yaml
index 7c4ae5a..a531eb4 100644
--- a/apps/kitchenowl/ingress.yaml
+++ b/apps/kitchenowl/ingress.yaml
@@ -24,7 +24,12 @@ metadata:
   name: kitchenowl
 spec:
   headers:
+    accessControlAllowOriginList:
+      - "*"
+    accessControlAllowCredentials: true
+    accessControlAllowHeaders: [ "Authorization","Content-Type" ] # "Accept","Origin"
+    accessControlAllowMethods: [ "GET","HEAD","OPTIONS" ] # "POST","PUT"
+    accessControlMaxAge: 100
     customRequestHeaders:
-      X-Forwarded-Proto: "https"
-      # enable websockets
+      Connection: keep-alive, Upgrade
       Upgrade: "websocket"