diff --git a/src/routes/root.ts b/src/routes/root.ts
index 6209f8e..3c61e9d 100644
--- a/src/routes/root.ts
+++ b/src/routes/root.ts
@@ -14,7 +14,7 @@ const DOWNLOADS_BASE = '/downloads/'
 
 const { preflight } = cors({
 	origin: '*',
-	allowMethods: ['GET', 'POST', 'DELETE', 'OPTIONS'],
+	allowMethods: ['GET', 'POST', 'DELETE', 'OPTIONS', 'PUT'],
 	allowHeaders: ['Content-Type'],
 })
 
@@ -25,7 +25,10 @@ const { preflight } = cors({
  */
 function corsify(response: Response): Response {
 	// Skip if CORS headers already present or if it's a WebSocket upgrade
-	if (response.headers.get('access-control-allow-origin') || response.status === 101) {
+	if (
+		response.headers.get('access-control-allow-origin') ||
+		response.status === 101
+	) {
 		return response
 	}
 	// Create new headers with CORS header added
diff --git a/test/cors.test.ts b/test/cors.test.ts
index 5098fed..ff9ea71 100644
--- a/test/cors.test.ts
+++ b/test/cors.test.ts
@@ -36,7 +36,7 @@ describe('CORS Headers', () => {
 		expect(response.status).toBe(204)
 		expect(response.headers.get('access-control-allow-origin')).toBe('*')
 		expect(response.headers.get('access-control-allow-methods')).toBe(
-			'GET,POST,DELETE,OPTIONS',
+			'GET,POST,DELETE,OPTIONS,PUT',
 		)
 		expect(response.headers.get('access-control-allow-headers')).toBe(
 			'Content-Type',
@@ -51,7 +51,7 @@ describe('CORS Headers', () => {
 		expect(response.status).toBe(204)
 		expect(response.headers.get('access-control-allow-origin')).toBe('*')
 		expect(response.headers.get('access-control-allow-methods')).toBe(
-			'GET,POST,DELETE,OPTIONS',
+			'GET,POST,DELETE,OPTIONS,PUT',
 		)
 	})
 
@@ -63,7 +63,7 @@ describe('CORS Headers', () => {
 		expect(response.status).toBe(204)
 		expect(response.headers.get('access-control-allow-origin')).toBe('*')
 		expect(response.headers.get('access-control-allow-methods')).toBe(
-			'GET,POST,DELETE,OPTIONS',
+			'GET,POST,DELETE,OPTIONS,PUT',
 		)
 	})