diff --git a/src/app.js b/src/app.js
index 54fe5addc884fb12396b4f29d700d03b7c6f3b7c..103cd143ada5313853d1e9b63fb8cfb3f93aa73d 100644
--- a/src/app.js
+++ b/src/app.js
@@ -51,6 +51,11 @@ const configureApp = app => {
   app.use(bodyParser.urlencoded({ extended: false }))
   app.use(cookieParser())
   app.use(helmet())
+
+  // Allow CORS from client if host / port is different
+  const CORSConfig = createCORSConfig()
+  app.use(cors(CORSConfig))
+
   app.use(express.static(path.resolve('.', '_build')))
   app.use(express.static(path.resolve('.', 'static')))
 
@@ -61,10 +66,6 @@ const configureApp = app => {
     )
   }
 
-  // Allow CORS from client if host / port is different
-  const CORSConfig = createCORSConfig()
-  app.use(cors(CORSConfig))
-
   // Register passport authentication strategies
   app.use(passport.initialize())
   const authentication = require('pubsweet-server/src/authentication')