diff --git a/package.json b/package.json
index 7868be0..eb8173f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@subsquid/manifest",
   "type": "commonjs",
-  "version": "2.0.0-beta.5",
+  "version": "2.0.0-beta.6",
   "homepage": "https://www.subsquid.io",
   "repository": "https://github.com/subsquid/manifest.git",
   "license": "GPL-3.0-or-later",
diff --git a/src/schema.ts b/src/schema.ts
index e8512f7..ed38193 100644
--- a/src/schema.ts
+++ b/src/schema.ts
@@ -1,6 +1,11 @@
 import { extendedJoi as Joi } from './joi';
 import { RPC_ENDPOINT_NAMES } from './rpc_networks';
-import { ManifestProcessor, ManifestValue } from './types';
+import {
+  ManifestDeploymentConfig,
+  ManifestDeploymentCors,
+  ManifestProcessor,
+  ManifestValue,
+} from './types';
 
 export const SECRET_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 export const SQUID_NAME_PATTERN = /^[a-z0-9]([a-z0-9\-]*[a-z0-9])?$/;
@@ -91,7 +96,17 @@ export const manifestSchema = Joi.object<ManifestValue>({
     cmd: Joi.array().items(cmdSchema.required()).min(1),
   }).allow(null),
 
-  deploy: Joi.object({
+  deploy: Joi.object<ManifestDeploymentConfig>({
+    cors: Joi.object<ManifestDeploymentCors>({
+      enabled: Joi.boolean().default(true),
+      allow_origin: Joi.array().items(Joi.string()).single(),
+      allow_methods: Joi.array().items(Joi.string()).single(),
+      allow_headers: Joi.array().items(Joi.string()).single(),
+      expose_headers: Joi.array().items(Joi.string()).single(),
+      allow_credentials: Joi.boolean(),
+      max_age: Joi.number().integer().positive(),
+    }),
+
     addons: Joi.object({
       postgres: Joi.object({
         version: Joi.string().valid('14').default('14'),
diff --git a/src/types.ts b/src/types.ts
index eb7ed81..0c4e1a3 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -10,12 +10,24 @@ export type ManifestProcessor = {
   env?: Record<string, string>;
 };
 
+export type ManifestDeploymentCors = {
+  enabled: boolean;
+  allow_origin?: string[];
+  allow_methods?: string[];
+  allow_headers?: string[];
+  expose_headers?: string[];
+  allow_credentials?: boolean;
+  max_age?: number;
+};
+
 export type ManifestDeploymentConfig = {
   /**
    * @deprecated
    */
   secrets?: string[];
 
+  cors?: ManifestDeploymentCors;
+
   env?: Record<string, string>;
   addons?: {
     postgres?: {
diff --git a/yarn.lock b/yarn.lock
index a80a0d7..ddee059 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2622,7 +2622,7 @@ joi-to-json@^4.2.1:
     lodash "^4.17.21"
     semver-compare "^1.0.0"
 
-joi@^17.13.3:
+joi@17.13.3:
   version "17.13.3"
   resolved "https://registry.yarnpkg.com/joi/-/joi-17.13.3.tgz#0f5cc1169c999b30d344366d384b12d92558bcec"
   integrity sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==