diff --git a/src/gateway/public-gateway.mjs b/src/gateway/public-gateway.mjs
index ac9f3bf..d3db881 100644
--- a/src/gateway/public-gateway.mjs
+++ b/src/gateway/public-gateway.mjs
@@ -360,6 +360,9 @@ function proxyToUrl(upstreamUrl, reqPath) {
 // Sia-per-subdomain owners: if they omit `ip` from the parent, the fallback
 // still tries `s3` first as before.
 async function serve(res, name, reqPath, baseHref) {
+  // Public content: let pages on other origins (sirius.x, theseus.x) read a
+  // name's files with fetch(), e.g. Sirius Studio inlining a stylesheet.
+  res.setHeader("access-control-allow-origin", "*");
   let entry;
   try { entry = await resolve(name); } catch (e) { res.writeHead(502); return res.end("resolve error: " + e.message); }
   if (!entry) { res.writeHead(404, { "content-type": "text/html" }); return res.end(nx(name)); }