diff --git a/CHANGELOG.md b/CHANGELOG.md
index 42a7e6c2..671d1e27 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- changed: CORS headers included in `webpack.config.js` for local development
+
 ## 3.8.10 (2025-12-19)
 
 - fixed: Use HTTP fallback for transaction broadcast when WebSocket connections are unavailable
diff --git a/webpack.config.js b/webpack.config.js
index 25532e7c..4dc8f4bd 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -21,6 +21,16 @@ module.exports = {
   devtool: debug ? 'source-map' : undefined,
   devServer: {
     allowedHosts: 'all',
+    headers: {
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, PATCH, OPTIONS',
+      'Access-Control-Allow-Headers':
+        'X-Requested-With, content-type, Authorization',
+      'Cross-Origin-Resource-Policy': 'cross-origin',
+      // Cross-origin isolation headers required for SharedArrayBuffer (needed by mixFetch web workers)
+      'Cross-Origin-Opener-Policy': 'same-origin',
+      'Cross-Origin-Embedder-Policy': 'require-corp'
+    },
     hot: false,
     port: 8084,
     static: bundlePath