diff --git a/source/server/index.ts b/source/server/index.ts
index 388813f..4677cc5 100644
--- a/source/server/index.ts
+++ b/source/server/index.ts
@@ -12,6 +12,24 @@ app.set( 'trust proxy', 1 );
 app.use( express.json() );
 app.use( cookieParser() );
 
+// CORS for public font resources — only allowed origins receive the header
+const CORS_ALLOWED: Array<string | RegExp> = [
+  /^https?:\/\/([\w-]+\.)?rokojori\.com$/,
+];
+
+function allowFontCors( req: express.Request, res: express.Response, next: express.NextFunction ): void
+{
+  const origin = req.headers.origin;
+  if ( origin && CORS_ALLOWED.some( rule => typeof rule === 'string' ? rule === origin : rule.test( origin ) ) )
+  {
+    res.set( 'Access-Control-Allow-Origin', origin );
+  }
+  next();
+}
+
+app.use( '/get-font', allowFontCors );
+app.use( '/fonts',    allowFontCors );
+
 // Public: font CSS endpoint
 app.use( publicFontsRouter );