diff --git a/infra/gitea/docker-compose.yml b/infra/gitea/docker-compose.yml
index af12bde..1caa404 100644
--- a/infra/gitea/docker-compose.yml
+++ b/infra/gitea/docker-compose.yml
@@ -14,6 +14,15 @@ services:
       - GITEA__server__SSH_DOMAIN=git.vienalatina.com
       - GITEA__service__DISABLE_REGISTRATION=true
       - GITEA__webhook__ALLOWED_HOST_LIST=ci.vienalatina.com
+      # Decap is served from vienalatina.com but exchanges its OAuth code for a
+      # token by calling git.vienalatina.com from the browser — a cross-origin
+      # request. Without this, Gitea returns no Access-Control-Allow-Origin, the
+      # browser drops the response, and Decap reports "TypeError: Failed to
+      # fetch" right after you authorize, which reads like a Decap bug.
+      - GITEA__cors__ENABLED=true
+      - GITEA__cors__ALLOW_DOMAIN=https://vienalatina.com
+      - GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
+      - GITEA__cors__HEADERS=Content-Type,User-Agent,Authorization
     volumes:
       - ./data:/data
       - /etc/timezone:/etc/timezone:ro