diff --git a/server/media/oss/oss.go b/server/media/oss/oss.go
index 5e00f0c..c1511a9 100644
--- a/server/media/oss/oss.go
+++ b/server/media/oss/oss.go
@@ -225,10 +225,9 @@ func (oh *ossHandler) Headers(tenantID types.TenantID, method string, url *url.U
 	}
 
 	if fdef.ETag != "" && strings.Trim(headers.Get("If-None-Match"), "\"") == fdef.ETag {
-		return http.Header{
-			"ETag":          {`"` + fdef.ETag + `"`},
-			"Cache-Control": {oh.conf.CacheControl},
-		}, http.StatusNotModified, nil
+		headers.Set("ETag", `"`+fdef.ETag+`"`)
+		headers.Set("Cache-Control", oh.conf.CacheControl)
+		return headers, http.StatusNotModified, nil
 	}
 	objectKey, err := oh.resolveObjectKey(fdef.Location)
 	if err != nil {
@@ -253,12 +252,14 @@ func (oh *ossHandler) Headers(tenantID types.TenantID, method string, url *url.U
 	}
 
 	if redirURL != "" {
-		return http.Header{
-			"Location":      {normalizeSignedRedirectURL(redirURL)},
-			"ETag":          {`"` + fdef.ETag + `"`},
-			"Content-Type":  {"application/json; charset=utf-8"},
-			"Cache-Control": {oh.conf.CacheControl},
-		}, http.StatusFound, nil
+		// Keep the CORS and Vary headers produced above. Replacing the map here
+		// makes preflight succeed but causes the actual browser GET to fail with
+		// MissingAllowOriginHeader before it can follow the signed OSS redirect.
+		headers.Set("Location", normalizeSignedRedirectURL(redirURL))
+		headers.Set("ETag", `"`+fdef.ETag+`"`)
+		headers.Set("Content-Type", "application/json; charset=utf-8")
+		headers.Set("Cache-Control", oh.conf.CacheControl)
+		return headers, http.StatusFound, nil
 	}
 	return nil, 0, nil
 }