diff --git a/code/core/src/core-server/dev-server.ts b/code/core/src/core-server/dev-server.ts
index da9cf0cb6042..1280a698bb8a 100644
--- a/code/core/src/core-server/dev-server.ts
+++ b/code/core/src/core-server/dev-server.ts
@@ -46,24 +46,26 @@ export async function storybookDevServer(options: Options) {
   const storyIndexGeneratorPromise =
     options.presets.apply<StoryIndexGenerator>('storyIndexGenerator');
 
-  registerIndexJsonRoute({
-    app,
-    storyIndexGeneratorPromise,
-    normalizedStories,
-    serverChannel,
-    workingDir,
-    configDir,
-  });
-
   app.use(compression({ level: 1 }));
 
   if (typeof options.extendServer === 'function') {
     options.extendServer(server);
   }
 
+  // CORS middleware must be registered BEFORE route handlers to ensure all routes
+  // (including /index.json) receive proper CORS headers for Storybook Composition
   app.use(getAccessControlMiddleware(core?.crossOriginIsolated ?? false));
   app.use(getCachingMiddleware());
 
+  registerIndexJsonRoute({
+    app,
+    storyIndexGeneratorPromise,
+    normalizedStories,
+    serverChannel,
+    workingDir,
+    configDir,
+  });
+
   (await getMiddleware(options.configDir))(app);
 
   // Apply experimental_devServer preset to allow addons/frameworks to extend the dev server with middlewares, etc.