diff --git a/routes/file/_middleware.ts b/routes/file/_middleware.ts
index 2e710a6..1c6bdab 100644
--- a/routes/file/_middleware.ts
+++ b/routes/file/_middleware.ts
@@ -26,8 +26,8 @@ export async function handler(req: Request, ctx: FreshContext) {
             const c = m.cfg.cors_credentials_hosts.includes(origin);
             headers.set("Access-Control-Allow-Origin", origin);
             if (c) headers.set("Access-Control-Allow-Credentials", "true");
-            headers.append("Vary", "Origin");
         }
+        headers.append("Vary", "Origin");
         return new Response(res.body, {
             status: res.status,
             headers: headers,