diff --git a/packages/web/index.html b/packages/web/index.html
index 049e1cdb..20ef4d63 100644
--- a/packages/web/index.html
+++ b/packages/web/index.html
@@ -198,6 +198,9 @@
 
       const manifestLink = document.createElement('link');
       manifestLink.rel = 'manifest';
+      // Required so the browser sends auth cookies when fetching the manifest,
+      // enabling PWA installation behind authentication proxies (e.g. Cloudflare Access).
+      manifestLink.crossOrigin = 'use-credentials';
       document.head.appendChild(manifestLink);
 
       let activeManifestBlobUrl = null;