diff --git a/dynamic/services.yaml b/dynamic/services.yaml
index 2ebb818..a678bb4 100644
--- a/dynamic/services.yaml
+++ b/dynamic/services.yaml
@@ -35,6 +35,11 @@ http:
         customRequestHeaders:
           Connection: "Upgrade"
           Upgrade: "websocket"
+      # Preserve auth headers for WS
+      accessControlAllowHeaders:
+        - Authorization
+        - Sec-Websocket-Protocol
+        - Sec-Websocket-Key
 
     dcr-cors:
       headers: