diff --git a/nix/apps/hugo-chat/default.nix b/nix/apps/hugo-chat/default.nix
index 2229650..986d9b7 100644
--- a/nix/apps/hugo-chat/default.nix
+++ b/nix/apps/hugo-chat/default.nix
@@ -62,27 +62,35 @@ in
     "api.hugo-chat.noratrieb.dev" =
       let
         cors = pkgs.writeText "cors" ''
-          @cors_preflight {
-            method OPTIONS
-            header Origin *
-          }
+          # https://gist.github.com/ryanburnette/d13575c9ced201e73f8169d3a793c1a3
+          @cors_preflight{args[0]} method OPTIONS
+          @cors{args[0]} header Origin {args[0]}
 
-          handle @cors_preflight {
+          handle @cors_preflight{args[0]} {
             header {
-              Access-Control-Allow-Origin "*"
-              Access-Control-Allow-Methods "*"
-              Access-Control-Allow-Headers "content-type"
+              Access-Control-Allow-Origin "{args[0]}"
+              Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+              Access-Control-Allow-Credentials "false"
+              Access-Control-Allow-Headers "$${args[1]}"
+              Access-Control-Max-Age "86400"
+              defer
             }
-            respond 204
+            respond "" 204
           }
 
-    
+          handle @cors{args[0]} {
+            header {
+              Access-Control-Allow-Origin "{args[0]}"
+              Access-Control-Expose-Headers *
+              defer
+            }
+          }
         '';
       in
       {
         logFormat = "";
         extraConfig = ''
-          import ${cors}
+          import ${cors} https://hugo-chat.noratrieb.dev "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type"
           encode zstd gzip
           reverse_proxy * localhost:5001
         '';
diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json
index 1efe252..c3d3918 100644
--- a/nix/nixpkgs.json
+++ b/nix/nixpkgs.json
@@ -1,10 +1,10 @@
 {
   "nixos-25.05": {
-    "lastUpdated": "2026-01-31T13:55:04.757Z",
-    "commit": "ac62194c3917d5f474c1a844b6fd6da2db95077d"
+    "lastUpdated": "2025-12-22T11:35:31.967Z",
+    "commit": "2b0d2b456e4e8452cf1c16d00118d145f31160f9"
   },
   "nixos-25.11": {
-    "lastUpdated": "2026-01-31T13:55:04.922Z",
-    "commit": "fa83fd837f3098e3e678e6cf017b2b36102c7211"
+    "lastUpdated": "2025-12-22T11:35:32.154Z",
+    "commit": "b3aad468604d3e488d627c0b43984eb60e75e782"
   }
 }