diff --git a/src/shared/http/plugins/security.ts b/src/shared/http/plugins/security.ts
index 57f31d1..8ed0264 100644
--- a/src/shared/http/plugins/security.ts
+++ b/src/shared/http/plugins/security.ts
@@ -26,6 +26,14 @@ export default fp(async function securityPlugin(app: FastifyInstance) {
         objectSrc: ["'none'"],
       },
     },
+    // Helmet's default is `same-origin`, which is enforced by browsers
+    // independently of CORS: it blocks allow-listed cross-origin clients
+    // from loading this API's responses at all via a no-CORS-mode request
+    // (e.g. displaying an uploaded evidence image with `<img src=...>`).
+    // Since CORS_ORIGIN already allow-lists the cooperating client origins,
+    // relax CORP to let those resources load — `same-origin` would silently
+    // break them regardless of the CORS configuration.
+    crossOriginResourcePolicy: { policy: 'cross-origin' },
   });
 
   await app.register(cors, {