diff --git a/cmd/main.go b/cmd/main.go
index 8f7bbad..b524b92 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -108,7 +108,7 @@ func NewRootCmd(v *viper.Viper) *cobra.Command {
 	// CORS configuration
 	rootCmd.PersistentFlags().String("cors.allow-origin", "*", "CORS allowed origin")
 	rootCmd.PersistentFlags().String("cors.allow-methods", "GET, POST, PUT, DELETE, OPTIONS", "CORS allowed methods")
-	rootCmd.PersistentFlags().String("cors.allow-headers", "Content-Type, Authorization", "CORS allowed headers")
+	rootCmd.PersistentFlags().String("cors.allow-headers", "Content-Type, Authorization, Traceparent, Baggage", "CORS allowed headers")
 
 	// Metrics configuration
 	rootCmd.PersistentFlags().Bool("metrics.enabled", true, "Enable metrics server")
diff --git a/testdata/local.yaml b/testdata/local.yaml
index e7cda5e..28e085f 100644
--- a/testdata/local.yaml
+++ b/testdata/local.yaml
@@ -30,7 +30,7 @@ health:
 cors:
   allow-origin: "*"
   allow-methods: "GET, POST, PUT, DELETE, OPTIONS"
-  allow-headers: "Content-Type, Authorization"
+  allow-headers: "Content-Type, Authorization, Traceparent, Baggage"
 
 metrics:
   enabled: true