diff --git a/make_post_sell/static/js/sandbox.js b/make_post_sell/static/js/sandbox.js
index 3f53f69..25c24df 100644
--- a/make_post_sell/static/js/sandbox.js
+++ b/make_post_sell/static/js/sandbox.js
@@ -101,10 +101,23 @@
     buildSliders();
     buildActions();
     buildFaceSection();
+    enableCrossOrigin();
     restoreState();
     setupEvents();
   }
 
+  // Set crossOrigin on all images so canvas export can read pixels.
+  // The CDN already serves Access-Control-Allow-Origin: * but the
+  // browser only sends the Origin header when crossOrigin is set.
+  function enableCrossOrigin() {
+    var imgs = document.querySelectorAll('img');
+    for (var i = 0; i < imgs.length; i++) {
+      if (!imgs[i].crossOrigin) {
+        imgs[i].crossOrigin = 'anonymous';
+      }
+    }
+  }
+
   function resetSliderValues() {
     for (var i = 0; i < SLIDERS.length; i++) {
       sliderValues[SLIDERS[i].id] = SLIDERS[i].dflt;
@@ -275,6 +288,7 @@
   window.sandboxReapply = function() {
     // Small delay to let new DOM settle
     setTimeout(function() {
+      enableCrossOrigin();
       applyCurrentFilter();
     }, 50);
   };