diff --git a/nginx/default.conf b/nginx/default.conf
index 428925e..89d09cc 100644
--- a/nginx/default.conf
+++ b/nginx/default.conf
@@ -6,20 +6,19 @@ server {
     root /var/lib/arma-tiles;
     etag on;
 
+    # Keep these at server level. Named fallback locations inherit them, so each
+    # response has exactly one CORS value instead of the invalid "*, *".
+    add_header Cache-Control "public, max-age=86400, stale-while-revalidate=604800" always;
+    add_header Access-Control-Allow-Origin "*" always;
+    add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "Origin, Range, Accept" always;
+
     # Public API is x/y/z. try_files performs an internal lookup at z/x/y.png.
     location ~ ^/tiles/(?<tile_x>[0-9]+)/(?<tile_y>[0-9]+)/(?<tile_z>[0-9]+)$ {
         if ($request_method = OPTIONS) {
-            add_header Access-Control-Allow-Origin "*" always;
-            add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
-            add_header Access-Control-Allow-Headers "Origin, Range, Accept" always;
-            add_header Content-Length 0;
             return 204;
         }
         try_files /tiles/$tile_z/$tile_x/$tile_y.png @callback_provider_tile;
-        add_header Cache-Control "public, max-age=86400, stale-while-revalidate=604800" always;
-        add_header Access-Control-Allow-Origin "*" always;
-        add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
-        add_header Access-Control-Allow-Headers "Origin, Range, Accept" always;
     }
 
     # A callback-provider base layer fills transparent edges when configured.
diff --git a/scripts/callback_provider.py b/scripts/callback_provider.py
index 7c74333..f33a211 100644
--- a/scripts/callback_provider.py
+++ b/scripts/callback_provider.py
@@ -59,15 +59,10 @@ def validate_callback_provider(value: str | None) -> CallbackProvider | None:
     return CallbackProvider(origin=f"https://{parsed.netloc}", path_template=parsed.path)
 
 
-def render_location(name: str, provider: CallbackProvider | None, x: str, y: str, z: str, label: str) -> str:
-    headers = """        add_header Cache-Control \"public, max-age=86400, stale-while-revalidate=604800\" always;
-        add_header Access-Control-Allow-Origin \"*\" always;
-        add_header Access-Control-Allow-Methods \"GET, HEAD, OPTIONS\" always;
-        add_header Access-Control-Allow-Headers \"Origin, Range, Accept\" always;"""
+def render_location(name: str, provider: CallbackProvider | None, x: str, y: str, z: str) -> str:
     if provider is None:
         return f"""location @{name} {{
         try_files /tiles/empty.png =500;
-{headers}
     }}
 """
     rendered_path = provider.path_template.replace("{x}", f"${x}").replace("{y}", f"${y}").replace("{z}", f"${z}")
@@ -79,8 +74,10 @@ def render_location(name: str, provider: CallbackProvider | None, x: str, y: str
         proxy_cache callback_provider;
         proxy_cache_valid 200 7d;
         proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
-        add_header X-Map-Source \"Callback provider {label}\" always;
-{headers}
+        proxy_hide_header Cache-Control;
+        proxy_hide_header Access-Control-Allow-Origin;
+        proxy_hide_header Access-Control-Allow-Methods;
+        proxy_hide_header Access-Control-Allow-Headers;
     }}
 """
 
@@ -88,9 +85,9 @@ def render_location(name: str, provider: CallbackProvider | None, x: str, y: str
 def render_nginx(provider: CallbackProvider | None) -> str:
     return (
         "# Generated at container startup. Do not edit.\n"
-        + render_location("callback_provider_tile", provider, "tile_x", "tile_y", "tile_z", "fallback")
+        + render_location("callback_provider_tile", provider, "tile_x", "tile_y", "tile_z")
         + "\n"
-        + render_location("callback_provider_base", provider, "base_x", "base_y", "base_z", "base")
+        + render_location("callback_provider_base", provider, "base_x", "base_y", "base_z")
     )