diff --git a/cmd/karma/tests/testscript/invalid_alertmanager_cors_credentials.txt b/cmd/karma/tests/testscript/invalid_alertmanager_cors_credentials.txt
new file mode 100644
index 000000000..f0b87303a
--- /dev/null
+++ b/cmd/karma/tests/testscript/invalid_alertmanager_cors_credentials.txt
@@ -0,0 +1,12 @@
+# Raises an error if we cors.credentials value is incorrect
+karma.bin-should-fail --log.format=text --log.config=false --log.level=error --config.file karma.yaml
+! stdout .
+stderr 'msg="Invalid cors.credentials value ''foo'' for alertmanager ''am1'', allowed options: omit, inclue, same-origin'
+
+-- karma.yaml --
+alertmanager:
+  servers:
+    - name: am1
+      uri: https://localhost:9093
+      cors:
+        credentials: foo
diff --git a/cmd/karma/tests/testscript/log_full_config_file_invalid_values.txt b/cmd/karma/tests/testscript/log_full_config_file_invalid_values.txt
index f9121037e..409faa013 100644
--- a/cmd/karma/tests/testscript/log_full_config_file_invalid_values.txt
+++ b/cmd/karma/tests/testscript/log_full_config_file_invalid_values.txt
@@ -11,6 +11,8 @@ alertmanager:
       uri: "http://localhost:9093"
       timeout: bbb
       proxy: YEs
+      cors:
+        credentials: foo
     - name: ha2
       uri: "http://localhost:9094"
       timeout: 11
@@ -58,6 +60,7 @@ ui:
 
 -- expected.stderr --
 level=fatal msg="Failed to unmarshal configuration: 12 error(s) decoding:\n\n* 'Alertmanager.Servers[2].Headers[0]' expected a map, got 'string'\n* cannot parse 'Alertmanager.Servers[0].Proxy' as bool: strconv.ParseBool: parsing \"YEs\": invalid syntax\n* cannot parse 'Annotations.Default.Hidden' as bool: strconv.ParseBool: parsing \"z\": invalid syntax\n* cannot parse 'UI.alertsPerGroup' as int: strconv.ParseInt: parsing \"5a\": invalid syntax\n* cannot parse 'UI.colorTitlebar' as bool: strconv.ParseBool: parsing \"yum\": invalid syntax\n* cannot parse 'UI.hideFiltersWhenIdle' as bool: strconv.ParseBool: parsing \"z\": invalid syntax\n* cannot parse 'UI.minimalGroupWidth' as int: strconv.ParseInt: parsing \"abc4\": invalid syntax\n* cannot parse 'alertAcknowledgement.Enabled' as bool: strconv.ParseBool: parsing \"zzz\": invalid syntax\n* error decoding 'Alertmanager.Interval': time: invalid duration jjs88\n* error decoding 'Alertmanager.Servers[0].Timeout': time: invalid duration bbb\n* error decoding 'Alertmanager.Servers[2].Timeout': time: invalid duration z\n* error decoding 'UI.Refresh': time: unknown unit sm in duration 10sm"
+level=fatal msg="Invalid alertmanager.cors.credentials value '', allowed options: omit, inclue, same-origin"
 level=fatal msg="Invalid grid.sorting.order value '', allowed options: disabled, startsAt, label"
 level=fatal msg="Invalid ui.collapseGroups value '', allowed options: expanded, collapsed, collapsedOnMobile"
 level=fatal msg="Invalid ui.theme value '', allowed options: light, dark, auto"
diff --git a/internal/config/config.go b/internal/config/config.go
index e0df17bd7..883094aa9 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -277,6 +277,10 @@ func (config *configSchema) Read(flags *pflag.FlagSet) string {
 		log.Fatalf("silenceform.author.populate_from_header.value_re is required when silenceform.author.populate_from_header.header is set")
 	}
 
+	if !slices.StringInSlice([]string{"omit", "include", "same-origin"}, config.Alertmanager.CORS.Credentials) {
+		log.Fatalf("Invalid alertmanager.cors.credentials value '%s', allowed options: omit, inclue, same-origin", config.Alertmanager.CORS.Credentials)
+	}
+
 	for i, s := range config.Alertmanager.Servers {
 		if s.Timeout.Seconds() == 0 {
 			config.Alertmanager.Servers[i].Timeout = config.Alertmanager.Timeout
@@ -284,6 +288,9 @@ func (config *configSchema) Read(flags *pflag.FlagSet) string {
 		if s.CORS.Credentials == "" {
 			config.Alertmanager.Servers[i].CORS.Credentials = config.Alertmanager.CORS.Credentials
 		}
+		if !slices.StringInSlice([]string{"omit", "include", "same-origin"}, config.Alertmanager.Servers[i].CORS.Credentials) {
+			log.Fatalf("Invalid cors.credentials value '%s' for alertmanager '%s', allowed options: omit, inclue, same-origin", config.Alertmanager.Servers[i].CORS.Credentials, s.Name)
+		}
 	}
 
 	for labelName, customColors := range config.Labels.Color.Custom {
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index a045d95f5..610dd94d6 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -316,6 +316,22 @@ func TestInvalidUITheme(t *testing.T) {
 	}
 }
 
+func TestInvalidCORSCredentials(t *testing.T) {
+	resetEnv()
+	os.Setenv("ALERTMANAGER_CORS_CREDENTIALS", "foo")
+
+	log.SetLevel(log.PanicLevel)
+	defer func() { log.StandardLogger().ExitFunc = nil }()
+	var wasFatal bool
+	log.StandardLogger().ExitFunc = func(int) { wasFatal = true }
+
+	mockConfigRead()
+
+	if !wasFatal {
+		t.Error("Invalid alertmanager.cors.credentials value didn't cause log.Fatal()")
+	}
+}
+
 func TestDefaultConfig(t *testing.T) {
 	resetEnv()
 	log.SetLevel(log.ErrorLevel)