diff --git a/ops/set-minio-cors.sh b/ops/set-minio-cors.sh
new file mode 100644
index 0000000..ac5f1da
--- /dev/null
+++ b/ops/set-minio-cors.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+# Set global CORS allow-origin on MinIO instance (taxi-minio container).
+# This MinIO version does not expose per-bucket PutBucketCors; CORS is global.
+#
+# Run on VDS 100.64.0.12 as root. Idempotent — safe to re-run after origin list changes.
+set -e
+export TERM=xterm
+
+ALLOWED_ORIGINS="https://mechanic.pptaxi.ru,https://crm.pptaxi.ru,http://localhost:5173,http://localhost:8000"
+
+docker exec taxi-minio sh -c "
+  mc alias set local http://localhost:9000 \"\$MINIO_ROOT_USER\" \"\$MINIO_ROOT_PASSWORD\" >/dev/null
+  mc admin config set local api cors_allow_origin='$ALLOWED_ORIGINS'
+  echo
+  echo '=== verify cors_allow_origin ==='
+  mc admin config get local api | tr ' ' '\n' | grep '^cors_allow_origin='
+"