diff --git a/docker-compose.yml b/docker-compose.yml
index f9cc8ff..aefadf4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -83,6 +83,11 @@ services:
       FORGEJO__storage.repo-archive__MINIO_BASE_PATH: archives/
       # Live git repos still live on local disk under /data/git — S3 is only for LFS
       # and other cold blobs. Never point [repository] itself at S3.
+      # --- CORS (so hephaestus.x and other BCNR-served pages can list public repos) ---
+      FORGEJO__cors__ENABLED: "true"
+      FORGEJO__cors__ALLOW_DOMAIN: "*"
+      FORGEJO__cors__ALLOW_CREDENTIALS: "false"
+      FORGEJO__cors__METHODS: "GET,HEAD"
       # --- Quota (free tier: 500 MB per user) ---
       FORGEJO__quota__ENABLED: "true"
       FORGEJO__quota__DEFAULT_GROUPS: free