diff --git a/src/api.rs b/src/api.rs
index 661d455..517815c 100644
--- a/src/api.rs
+++ b/src/api.rs
@@ -100,10 +100,23 @@ pub fn build_router(state: AppState) -> Router {
             .filter_map(|s| s.parse().ok())
             .collect();
 
-        CorsLayer::new()
-            .allow_methods([Method::GET])
-            .allow_headers([header::CONTENT_TYPE])
-            .allow_origin(AllowOrigin::list(origins))
+        if origins.len() < state.config.allowed_origins.len() {
+            tracing::warn!(
+                "{} origin(s) failed to parse (non-ASCII?): {:?}",
+                state.config.allowed_origins.len() - origins.len(),
+                state.config.allowed_origins
+            );
+        }
+
+        if origins.is_empty() {
+            tracing::warn!("No valid origins configured — falling back to permissive CORS");
+            CorsLayer::permissive()
+        } else {
+            CorsLayer::new()
+                .allow_methods([Method::GET])
+                .allow_headers([header::CONTENT_TYPE])
+                .allow_origin(AllowOrigin::list(origins))
+        }
     };
 
     Router::new()
@@ -632,7 +645,7 @@ mod tests {
         AppState {
             conn: Arc::new(Mutex::new(conn)),
             config: Arc::new(Config {
-                allowed_origins: vec!["https://hagfisk.poc.fló.fo".to_string()],
+                allowed_origins: vec!["https://hagfisk.poc.xn--fl-5ka.fo".to_string()],
                 ..Default::default()
             }),
         }