diff --git a/cmd/homerunner/README.md b/cmd/homerunner/README.md
index f0f19136..1635b3b6 100644
--- a/cmd/homerunner/README.md
+++ b/cmd/homerunner/README.md
@@ -28,7 +28,7 @@ HOMERUNNER_KEEP_BLUEPRINTS='name-of-blueprint' ./homerunner
 ```
 This is neccessary to stop Homerunner from cleaning up the image. Then perform a single POST request:
 ```
-curl -XPOST -d '{"blueprint_name":"name-of-blueprint"}'
+curl -XPOST -d '{"blueprint_name":"name-of-blueprint"}' http://localhost:54321/create
 {
   "homeservers":{
     "hs1":{
diff --git a/cmd/homerunner/routes.go b/cmd/homerunner/routes.go
index 616524fe..38b6e44b 100644
--- a/cmd/homerunner/routes.go
+++ b/cmd/homerunner/routes.go
@@ -10,8 +10,8 @@ import (
 
 func Routes(rt *Runtime, cfg *Config) http.Handler {
 	mux := mux.NewRouter()
-	mux.Path("/create").Methods("POST").HandlerFunc(
-		util.WithCORSOptions(util.MakeJSONAPI(util.NewJSONRequestHandler(
+	mux.Path("/create").Methods("POST", "OPTIONS").HandlerFunc(
+		withCORS(util.MakeJSONAPI(util.NewJSONRequestHandler(
 			func(req *http.Request) util.JSONResponse {
 				rc := ReqCreate{}
 				if err := json.NewDecoder(req.Body).Decode(&rc); err != nil {
@@ -21,8 +21,8 @@ func Routes(rt *Runtime, cfg *Config) http.Handler {
 			},
 		))),
 	)
-	mux.Path("/destroy").Methods("POST").HandlerFunc(
-		util.WithCORSOptions(util.MakeJSONAPI(util.NewJSONRequestHandler(
+	mux.Path("/destroy").Methods("POST", "OPTIONS").HandlerFunc(
+		withCORS(util.MakeJSONAPI(util.NewJSONRequestHandler(
 			func(req *http.Request) util.JSONResponse {
 				rc := ReqDestroy{}
 				if err := json.NewDecoder(req.Body).Decode(&rc); err != nil {
@@ -32,10 +32,18 @@ func Routes(rt *Runtime, cfg *Config) http.Handler {
 			},
 		))),
 	)
-	mux.Path("/health").Methods("GET").HandlerFunc(
-		func(res http.ResponseWriter, req *http.Request) {
+	mux.Path("/health").Methods("GET", "OPTIONS").HandlerFunc(
+		withCORS(func(res http.ResponseWriter, req *http.Request) {
 			res.WriteHeader(200)
-		},
+		}),
 	)
 	return mux
 }
+
+// withCORS intercepts all requests and adds CORS headers.
+func withCORS(handler http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, req *http.Request) {
+		util.SetCORSHeaders(w)
+		handler(w, req)
+	}
+}