diff --git a/s3api/router.go b/s3api/router.go
index 3ab8c66b..15161e20 100644
--- a/s3api/router.go
+++ b/s3api/router.go
@@ -209,11 +209,11 @@ func (sa *S3ApiRouter) Init() {
 			metrics.ActionPutBucketOwnershipControls,
 			services,
 			middlewares.BucketObjectNameValidator(),
+			applyBucketCORS,
 			middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketOwnershipControls, auth.PutBucketOwnershipControlsAction, auth.PermissionWrite, sa.region, false),
 			middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false),
 			middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false),
 			middlewares.VerifyChecksums(false, true, false),
-			applyBucketCORS,
 			middlewares.ParseAcl(sa.be),
 		))
 	bucketRouter.Put("",
@@ -223,11 +223,11 @@ func (sa *S3ApiRouter) Init() {
 			metrics.ActionPutBucketVersioning,
 			services,
 			middlewares.BucketObjectNameValidator(),
+			applyBucketCORS,
 			middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketVersioning, auth.PutBucketVersioningAction, auth.PermissionWrite, sa.region, false),
 			middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false),
 			middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false),
 			middlewares.VerifyChecksums(false, true, false),
-			applyBucketCORS,
 			middlewares.ParseAcl(sa.be),
 		))
 	bucketRouter.Put("",
@@ -237,11 +237,11 @@ func (sa *S3ApiRouter) Init() {
 			metrics.ActionPutObjectLockConfiguration,
 			services,
 			middlewares.BucketObjectNameValidator(),
+			applyBucketCORS,
 			middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObjectLockConfiguration, auth.PutBucketObjectLockConfigurationAction, auth.PermissionWrite, sa.region, false),
 			middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false),
 			middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false),
 			middlewares.VerifyChecksums(false, true, true),
-			applyBucketCORS,
 			middlewares.ParseAcl(sa.be),
 		))
 	bucketRouter.Put("",
@@ -251,11 +251,11 @@ func (sa *S3ApiRouter) Init() {
 			metrics.ActionPutBucketCors,
 			services,
 			middlewares.BucketObjectNameValidator(),
+			applyBucketCORS,
 			middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketCors, auth.PutBucketCorsAction, auth.PermissionWrite, sa.region, false),
 			middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false),
 			middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false),
 			middlewares.VerifyChecksums(false, true, true),
-			applyBucketCORS,
 			middlewares.ParseAcl(sa.be),
 		))
 	bucketRouter.Put("",
@@ -265,11 +265,11 @@ func (sa *S3ApiRouter) Init() {
 			metrics.ActionPutBucketPolicy,
 			services,
 			middlewares.BucketObjectNameValidator(),
+			applyBucketCORS,
 			middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketPolicy, auth.PutBucketPolicyAction, auth.PermissionWrite, sa.region, false),
 			middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false),
 			middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false),
 			middlewares.VerifyChecksums(false, false, false),
-			applyBucketCORS,
 			middlewares.ParseAcl(sa.be),
 		))
 	bucketRouter.Put("",
@@ -279,11 +279,11 @@ func (sa *S3ApiRouter) Init() {
 			metrics.ActionPutBucketAcl,
 			services,
 			middlewares.BucketObjectNameValidator(),
+			applyBucketCORS,
 			middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketAcl, auth.PutBucketAclAction, auth.PermissionWriteAcp, sa.region, false),
 			middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false),
 			middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false),
 			middlewares.VerifyChecksums(false, false, false),
-			applyBucketCORS,
 			middlewares.ParseAcl(sa.be),
 		))
 	bucketRouter.Put("",
diff --git a/s3api/router_cors_test.go b/s3api/router_cors_test.go
index a7e06897..1738eeee 100644
--- a/s3api/router_cors_test.go
+++ b/s3api/router_cors_test.go
@@ -149,6 +149,35 @@ func TestS3ApiRouter_PutBucketTagging_ErrorStillIncludesFallbackCORS(t *testing.
 	}
 }
 
+func TestS3ApiRouter_PutObjectLockConfiguration_ErrorStillIncludesFallbackCORS(t *testing.T) {
+	origin := "http://127.0.0.1:9090"
+
+	app := fiber.New()
+	(&S3ApiRouter{
+		app:             app,
+		be:              backendWithCorsOnly{},
+		iam:             &auth.IAMServiceInternal{},
+		region:          "us-east-1",
+		corsAllowOrigin: origin,
+	}).Init()
+
+	req, err := http.NewRequest(http.MethodPut, "/testing?object-lock=", nil)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+	req.Host = "localhost"
+	req.Header.Set("Origin", origin)
+
+	resp, err := app.Test(req)
+	if err != nil {
+		t.Fatalf("app.Test: %v", err)
+	}
+
+	if got := resp.Header.Get("Access-Control-Allow-Origin"); got != origin {
+		t.Fatalf("expected Access-Control-Allow-Origin %q, got %q", origin, got)
+	}
+}
+
 func TestS3ApiRouter_PutObjectTagging_ErrorStillIncludesFallbackCORS(t *testing.T) {
 	origin := "http://127.0.0.1:9090"