diff --git a/src/c3nav/mapdata/api.py b/src/c3nav/mapdata/api.py
index 76b6d1fa..33f62bfe 100644
--- a/src/c3nav/mapdata/api.py
+++ b/src/c3nav/mapdata/api.py
@@ -442,6 +442,7 @@ class UpdatesViewSet(GenericViewSet):
         response = Response(result)
         if cross_origin:
             response['Access-Control-Allow-Origin'] = '*'
+            response['Access-Control-Allow-Credentials'] = 'true'
         set_tile_access_cookie(request, response)
 
         return response