diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index e69e9439..4cf0d426 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -221,6 +221,8 @@ http {
         }
 
         location = /.well-known/matrix/client {
+            include snippets/security-headers.conf;
+            add_header Cross-Origin-Resource-Policy "cross-origin" always;
             add_header Access-Control-Allow-Origin "*";
             default_type application/json;
         }