diff --git a/crm/routes.go b/crm/routes.go
index 535b3ab3a..f2a86eec8 100644
--- a/crm/routes.go
+++ b/crm/routes.go
@@ -7,20 +7,9 @@ import (
 
 	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
-	"github.com/go-chi/cors"
 )
 
 func mountRoutes(r chi.Router, opts *configuration, mounts ...func(r chi.Router)) {
-	// CORS for local development...
-	cors := cors.New(cors.Options{
-		AllowedOrigins:   []string{"*"},
-		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"},
-		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
-		AllowCredentials: true,
-		MaxAge:           300, // Maximum value not ignored by any of major browsers
-	})
-	r.Use(cors.Handler)
-
 	if opts.http.logging {
 		r.Use(middleware.Logger)
 	}
diff --git a/crm/start.go b/crm/start.go
index 9a1813aea..976835da6 100644
--- a/crm/start.go
+++ b/crm/start.go
@@ -13,6 +13,7 @@ import (
 	"github.com/crusttech/crust/auth"
 	"github.com/crusttech/crust/crm/rest"
 
+	"github.com/go-chi/cors"
 	"github.com/titpetric/factory"
 	"github.com/titpetric/factory/resputil"
 )
@@ -65,6 +66,7 @@ func Start() error {
 	}
 
 	r := chi.NewRouter()
+	r.Use(handleCORS)
 
 	// Only protect application routes with JWT
 	r.Group(func(r chi.Router) {
@@ -80,3 +82,14 @@ func Start() error {
 
 	return nil
 }
+
+// Sets up default CORS rules to use as a middleware
+func handleCORS(next http.Handler) http.Handler {
+	return cors.New(cors.Options{
+		AllowedOrigins:   []string{"*"},
+		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"},
+		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
+		AllowCredentials: true,
+		MaxAge:           300, // Maximum value not ignored by any of major browsers
+	}).Handler(next)
+}
diff --git a/sam/routes.go b/sam/routes.go
index dafa06b76..e91cc6082 100644
--- a/sam/routes.go
+++ b/sam/routes.go
@@ -7,19 +7,10 @@ import (
 
 	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
-	"github.com/go-chi/cors"
 )
 
 func mountRoutes(r chi.Router, opts *configuration, mounts ...func(r chi.Router)) {
-	// CORS for local development...
-	cors := cors.New(cors.Options{
-		AllowedOrigins:   []string{"*"},
-		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"},
-		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
-		AllowCredentials: true,
-		MaxAge:           300, // Maximum value not ignored by any of major browsers
-	})
-	r.Use(cors.Handler)
+	r.Use(handleCORS)
 
 	if opts.http.logging {
 		r.Use(middleware.Logger)
diff --git a/sam/start.go b/sam/start.go
index be8ab2719..329c5b859 100644
--- a/sam/start.go
+++ b/sam/start.go
@@ -14,6 +14,7 @@ import (
 	"github.com/crusttech/crust/sam/rest"
 	"github.com/crusttech/crust/sam/websocket"
 
+	"github.com/go-chi/cors"
 	"github.com/titpetric/factory"
 	"github.com/titpetric/factory/resputil"
 )
@@ -66,6 +67,7 @@ func Start() error {
 	}
 
 	r := chi.NewRouter()
+	r.Use(handleCORS)
 
 	// Only protect application routes with JWT
 	r.Group(func(r chi.Router) {
@@ -81,3 +83,14 @@ func Start() error {
 
 	return nil
 }
+
+// Sets up default CORS rules to use as a middleware
+func handleCORS(next http.Handler) http.Handler {
+	return cors.New(cors.Options{
+		AllowedOrigins:   []string{"*"},
+		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"},
+		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
+		AllowCredentials: true,
+		MaxAge:           300, // Maximum value not ignored by any of major browsers
+	}).Handler(next)
+}