diff --git a/changelog.d/5-internal/WPB-5577 b/changelog.d/5-internal/WPB-5577
new file mode 100644
index 0000000000..f8e7aad828
--- /dev/null
+++ b/changelog.d/5-internal/WPB-5577
@@ -0,0 +1 @@
+`Reply-Nonce` is added to `Access-Control-Expose-Headers`
diff --git a/charts/nginz/templates/conf/_nginx.conf.tpl b/charts/nginz/templates/conf/_nginx.conf.tpl
index 8341c1a7a3..d2c92d579b 100644
--- a/charts/nginz/templates/conf/_nginx.conf.tpl
+++ b/charts/nginz/templates/conf/_nginx.conf.tpl
@@ -322,7 +322,7 @@ http {
 
         more_set_headers 'Access-Control-Allow-Origin: $cors_header';
 
-        more_set_headers 'Access-Control-Expose-Headers: Request-Id, Location';
+        more_set_headers 'Access-Control-Expose-Headers: Request-Id, Location, Replay-Nonce';
         more_set_headers 'Request-Id: $request_id';
         more_set_headers 'Strict-Transport-Security: max-age=31536000; preload';
     }
diff --git a/services/brig/test/integration/API/User/Client.hs b/services/brig/test/integration/API/User/Client.hs
index 106d06c6b8..03cc98eb49 100644
--- a/services/brig/test/integration/API/User/Client.hs
+++ b/services/brig/test/integration/API/User/Client.hs
@@ -1378,7 +1378,7 @@ testNewNonce :: Brig -> Http ()
 testNewNonce brig = do
   n1 <- check Util.getNonce 204
   n2 <- check Util.headNonce 200
-  lift $ assertBool "nonces are should not be equal" (n1 /= n2)
+  lift $ assertBool "nonces should not be equal" (n1 /= n2)
   where
     check f status = do
       uid <- userId <$> randomUser brig
@@ -1435,7 +1435,7 @@ testCreateAccessToken opts n brig = do
       <!! const 200 === statusCode
   let t = decodeToken rs
   cid <- createClientForUser brig uid
-  nonceResponse <- Util.headNonce brig uid cid <!! const 200 === statusCode
+  nonceResponse <- Util.headNonceNginz n t cid <!! const 200 === statusCode
   let nonceBs = cs $ fromMaybe (error "invalid nonce") $ getHeader "Replay-Nonce" nonceResponse
   now <- liftIO $ posixSecondsToUTCTime . fromInteger <$> (floor <$> getPOSIXTime)
   let clientIdentity = cs $ "im:wireapp=" <> cs (toText uidB64) <> "/" <> toByteString' cid <> "@" <> toByteString' localDomain
@@ -1453,6 +1453,8 @@ testCreateAccessToken opts n brig = do
   case signedOrError of
     Left err -> liftIO $ assertFailure $ "failed to sign claims: " <> show err
     Right signed -> do
+      let accessControlExposeHeaders = maybe "" cs $ getHeader "Access-Control-Expose-Headers" nonceResponse
+      liftIO $ assertBool "Access-Control-Expose-Headers should contain Replay-Nonce" $ "Replay-Nonce" `isInfixOf` accessControlExposeHeaders
       let proof = Just $ Proof (cs signed)
       response <- Util.createAccessTokenNginz n t cid proof
       let accessToken = fromRight (error $ "failed to create token: " <> show response) $ responseJsonEither response
diff --git a/services/brig/test/integration/API/User/Util.hs b/services/brig/test/integration/API/User/Util.hs
index 1675985ba5..baedb79212 100644
--- a/services/brig/test/integration/API/User/Util.hs
+++ b/services/brig/test/integration/API/User/Util.hs
@@ -584,6 +584,19 @@ nonce m brig uid cid =
         . zUser uid
     )
 
+headNonceNginz ::
+  MonadHttp m =>
+  Nginz ->
+  ZAuth.Token ZAuth.Access ->
+  ClientId ->
+  m ResponseLBS
+headNonceNginz nginz t cid =
+  Bilge.head
+    ( nginz
+        . paths ["clients", toByteString' cid, "nonce"]
+        . header "Authorization" ("Bearer " <> toByteString' t)
+    )
+
 createAccessToken :: (MonadHttp m, HasCallStack) => Brig -> UserId -> Text -> ClientId -> Maybe Proof -> m ResponseLBS
 createAccessToken brig uid h cid mProof =
   post $
diff --git a/services/nginz/integration-test/conf/nginz/common_response.conf b/services/nginz/integration-test/conf/nginz/common_response.conf
index 1b8a947f43..4b0308291b 100644
--- a/services/nginz/integration-test/conf/nginz/common_response.conf
+++ b/services/nginz/integration-test/conf/nginz/common_response.conf
@@ -19,7 +19,7 @@
       more_set_headers 'Access-Control-Allow-Credentials: true';
       # NOTE: This allows all origins, you may want to tune this value
       more_set_headers 'Access-Control-Allow-Origin: $http_origin';
-      more_set_headers 'Access-Control-Expose-Headers: Request-Id, Location';
+      more_set_headers 'Access-Control-Expose-Headers: Request-Id, Location, Replay-Nonce';
       more_set_headers 'Request-Id: $request_id';
       more_set_headers 'Strict-Transport-Security: max-age=31536000; preload';
 
@@ -31,7 +31,7 @@
             return 204;
         }
 
-        
+
       proxy_http_version 1.1;
 
       # NOTE: You may want to tune this