diff --git a/docs/_headers b/docs/_headers
new file mode 100644
index 0000000..938cab4
--- /dev/null
+++ b/docs/_headers
@@ -0,0 +1,5 @@
+# Cloudflare static-asset headers, copied to the site root by html_extra_path.
+# GitHub Pages sent this on every response. Without it, tools on other sites
+# cannot read the docs' files (objects.inv, images, JSON) from a browser.
+/*
+  Access-Control-Allow-Origin: *
diff --git a/docs/conf.py b/docs/conf.py
index a654524..adb43f0 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -168,8 +168,9 @@
 ogp_social_cards = {"enable": False}
 html_static_path = ["stylesheets"]
 html_css_files = ["extra.css"]
-# Cloudflare serves the site; _redirects maps directory URLs to index.html.
-html_extra_path = ["_redirects"]
+# Cloudflare serves the site; _redirects maps directory URLs to index.html and
+# _headers adds the CORS header that GitHub Pages used to send.
+html_extra_path = ["_redirects", "_headers"]
 html_theme_options = {
     "accent_color": "crimson",  # names the token family; stylesheets/extra.css re-tones the crimson scale to ledger oxblood
     "color_mode": "auto",  # follow the reader's light/dark preference