diff --git a/encord_agents/gcp/wrappers.py b/encord_agents/gcp/wrappers.py
index 4c411bb..3657c53 100644
--- a/encord_agents/gcp/wrappers.py
+++ b/encord_agents/gcp/wrappers.py
@@ -62,11 +62,9 @@ def context_wrapper_inner(func: AgentFunction) -> Callable[[Request], Response]:
 
         @wraps(func)
         def wrapper(request: Request) -> Response:
-            # Set CORS headers for the preflight request
             if request.method == "OPTIONS":
-                # Allows GET requests from any origin with the Content-Type
-                # header and caches preflight response for an 3600s
                 response = make_response("")
+                response.headers["Vary"] = "Origin"
 
                 origin_ok = False
                 for origin in ALLOWED_ORIGINS:
@@ -77,7 +75,7 @@ def wrapper(request: Request) -> Response:
                     return response
 
                 headers = {
-                    "Access-Control-Allow-Origin": "*",
+                    "Access-Control-Allow-Origin": request.origin,
                     "Access-Control-Allow-Methods": "POST",
                     "Access-Control-Allow-Headers": "Content-Type",
                     "Access-Control-Max-Age": "3600",