diff --git a/Jellyfin.Server/Middleware/DynamicCorsMiddleware.cs b/Jellyfin.Server/Middleware/DynamicCorsMiddleware.cs
index 4fad898a73..c4c491cdd8 100644
--- a/Jellyfin.Server/Middleware/DynamicCorsMiddleware.cs
+++ b/Jellyfin.Server/Middleware/DynamicCorsMiddleware.cs
@@ -52,12 +52,10 @@ namespace Jellyfin.Server.Middleware
                     && string.Equals(headerValue, "*", StringComparison.Ordinal))
                 {
                     context.Response.Headers[HeaderNames.AccessControlAllowOrigin] = context.Request.Host.Value;
-                    _logger.LogDebug("Overwriting CORS response header: {HeaderName}: {HeaderValue}", HeaderNames.AccessControlAllowOrigin, context.Request.Host.Value);
 
-                    if (!context.Response.Headers.ContainsKey(HeaderNames.AccessControlAllowCredentials))
-                    {
-                        context.Response.Headers[HeaderNames.AccessControlAllowCredentials] = "true";
-                    }
+                    // Always allow credentials.
+                    context.Response.Headers[HeaderNames.AccessControlAllowCredentials] = "true";
+                    _logger.LogDebug("Overwriting CORS response header: {HeaderName}: {HeaderValue}", HeaderNames.AccessControlAllowOrigin, context.Request.Host.Value);
                 }
             }