diff --git a/README.md b/README.md
index e39710e8..19be6714 100644
--- a/README.md
+++ b/README.md
@@ -113,6 +113,10 @@ spec:
           x-envoy-upstream-rq-timeout-ms: "15000"
           x-envoy-max-retries: "10"
           x-envoy-retry-on: "gateway-error,connect-failure,refused-stream"
+    # cross-origin resource sharing policy (optional)
+    corsPolicy:
+      allowOrigin:
+        - example.com
   # promote the canary without analysing it (default false)
   skipAnalysis: false
   # define the canary analysis timing and KPIs
diff --git a/docs/gitbook/how-it-works.md b/docs/gitbook/how-it-works.md
index 5935a819..92c045f2 100644
--- a/docs/gitbook/how-it-works.md
+++ b/docs/gitbook/how-it-works.md
@@ -132,6 +132,16 @@ metadata:
           x-envoy-upstream-rq-timeout-ms: "15000"
           x-envoy-max-retries: "10"
           x-envoy-retry-on: "gateway-error,connect-failure,refused-stream"
+    # cross-origin resource sharing policy (optional)
+    corsPolicy:
+      allowOrigin:
+        - example.com
+      allowMethods:
+        - GET
+      allowCredentials: false
+      allowHeaders:
+        - x-some-header
+      maxAge: 24h
     # retry policy when a HTTP request fails (optional)
     retries:
       attempts: 3
@@ -165,6 +175,14 @@ spec:
       x-envoy-max-retries: "10"
       x-envoy-retry-on: gateway-error,connect-failure,refused-stream
       x-envoy-upstream-rq-timeout-ms: "15000"
+    corsPolicy:
+      allowHeaders:
+      - x-some-header
+      allowMethods:
+      - GET
+      allowOrigin:
+      - example.com
+      maxAge: 24h
     match:
     - uri:
         prefix: /