diff --git a/pkg/appview/templates/components/head.html b/pkg/appview/templates/components/head.html
index caed8d3..abba47a 100644
--- a/pkg/appview/templates/components/head.html
+++ b/pkg/appview/templates/components/head.html
@@ -12,8 +12,12 @@
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
     <link rel="manifest" href="/site.webmanifest" />
 
-    <!-- Resource hints for external domains -->
-    <link rel="preconnect" href="https://imgs.blue" crossorigin>
+    <!-- Resource hints for external domains. No crossorigin on the
+         preconnect: avatars are plain <img src> fetches (no-cors), and
+         connections are keyed by credentials mode, so a CORS-mode
+         preconnect warms a socket nothing reuses. Fonts below are the
+         opposite case and do need crossorigin. -->
+    <link rel="preconnect" href="https://imgs.blue">
     <link rel="dns-prefetch" href="https://imgs.blue">
 
     <!-- Preload critical assets. Font list is discovered from the public FS