diff --git a/docs/_headers b/docs/_headers
new file mode 100644
index 000000000..938cab441
--- /dev/null
+++ b/docs/_headers
@@ -0,0 +1,5 @@
+# Cloudflare static-asset headers, copied to the site root by html_extra_path.
+# GitHub Pages sent this on every response. Without it, tools on other sites
+# cannot read the docs' files (objects.inv, images, JSON) from a browser.
+/*
+  Access-Control-Allow-Origin: *
diff --git a/docs/conf.py b/docs/conf.py
index cdf6d3bc9..357afc7b8 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -313,8 +313,9 @@
 html_favicon = "static/favicon.ico"
 # Cloudflare serves the docs with html_handling "none" (docs/wrangler.jsonc), so
 # a directory URL, such as / or a sphinx-reredirects stub, only serves its
-# index.html through the rules in _redirects.
-html_extra_path = ["_redirects"]
+# index.html through the rules in _redirects. _headers adds the CORS header that
+# GitHub Pages used to send.
+html_extra_path = ["_redirects", "_headers"]
 html_theme_options = {
     # `accent_color` only accepts a radix ramp *name*. shibuya writes the value
     # verbatim into `<html data-accent-color="...">` and its stylesheet carries