diff --git a/packages/agoric-cli/lib/chain-config.js b/packages/agoric-cli/lib/chain-config.js
index 3d04d8ccd30..58bc511a1af 100644
--- a/packages/agoric-cli/lib/chain-config.js
+++ b/packages/agoric-cli/lib/chain-config.js
@@ -25,12 +25,17 @@ export const DEFAULT_API_PORT = 1317;
 // Rewrite the app.toml.
 export function finishCosmosApp({
   appToml,
+  enableCors,
   exportMetrics,
   portNum = `${DEFAULT_RPC_PORT}`,
 }) {
   const rpcPort = Number(portNum);
   const app = TOML.parse(appToml);
 
+  if (enableCors) {
+    app.api['enabled-unsafe-cors'] = true;
+  }
+
   // Offset the GRPC listener from our rpc port.
   app.grpc.address = `0.0.0.0:${rpcPort +
     DEFAULT_GRPC_PORT -
@@ -56,6 +61,7 @@ export function finishCosmosApp({
 // Rewrite the config.toml.
 export function finishTendermintConfig({
   configToml,
+  enableCors,
   exportMetrics,
   portNum = `${DEFAULT_RPC_PORT}`,
   persistentPeers = '',
@@ -80,6 +86,14 @@ export function finishTendermintConfig({
   config.rpc.laddr = `tcp://0.0.0.0:${rpcPort}`;
   config.rpc.max_body_bytes = 15 * 10 ** 6;
 
+  if (
+    enableCors &&
+    (!config.rpc.cors_allowed_origins ||
+      config.rpc.cors_allowed_origins.length === 0)
+  ) {
+    config.rpc.cors_allowed_origins = ['*'];
+  }
+
   if (exportMetrics) {
     const promPort = rpcPort - DEFAULT_RPC_PORT + DEFAULT_PROM_PORT;
     config.instrumentation.prometheus = true;
diff --git a/packages/agoric-cli/lib/main.js b/packages/agoric-cli/lib/main.js
index 3e3524c50f8..c02beba06cf 100644
--- a/packages/agoric-cli/lib/main.js
+++ b/packages/agoric-cli/lib/main.js
@@ -111,6 +111,11 @@ const main = async (progname, rawArgs, powers) => {
   program
     .command('set-defaults <program> <config-dir>')
     .description('update the configuration files for <program> in <config-dir>')
+    .option(
+      '--enable-cors',
+      'open RPC and API endpoints to all cross-origin requests',
+      false,
+    )
     .option(
       '--export-metrics',
       'open ports to export Prometheus metrics',
diff --git a/packages/agoric-cli/lib/set-defaults.js b/packages/agoric-cli/lib/set-defaults.js
index d04d97931ac..996ce5cbd1a 100644
--- a/packages/agoric-cli/lib/set-defaults.js
+++ b/packages/agoric-cli/lib/set-defaults.js
@@ -17,7 +17,7 @@ export default async function setDefaultsMain(progname, rawArgs, powers, opts) {
     X`<prog> must currently be 'ag-chain-cosmos'`,
   );
 
-  const { exportMetrics } = opts;
+  const { exportMetrics, enableCors } = opts;
 
   let appFile;
   let configFile;
@@ -51,6 +51,7 @@ export default async function setDefaultsMain(progname, rawArgs, powers, opts) {
 
     const newAppToml = finishCosmosApp({
       appToml,
+      enableCors,
       exportMetrics,
     });
     await create(appFile, newAppToml);
@@ -63,6 +64,7 @@ export default async function setDefaultsMain(progname, rawArgs, powers, opts) {
 
     const newConfigToml = finishTendermintConfig({
       configToml,
+      enableCors,
       persistentPeers,
       seeds,
       unconditionalPeerIds,
diff --git a/packages/deployment/src/main.js b/packages/deployment/src/main.js
index 6f7a626f824..efecedfabd0 100644
--- a/packages/deployment/src/main.js
+++ b/packages/deployment/src/main.js
@@ -409,18 +409,24 @@ show-config      display the client connection parameters
         const allIds = await needBacktick(
           `${shellEscape(progname)} show-all-ids`,
         );
-        const faucetAddress = await needBacktick(
-          `${shellEscape(progname)} show-faucet-address`,
-        );
+        const hasPeers = dsts.find(dst => dst.startsWith('peer'));
         await Promise.all(
           dsts.map(async (dst, i) => {
             // Update the config.toml and genesis.json.
+            const corsFlags = [];
+            if (hasPeers && dst.startsWith('peer')) {
+              // Some "peers", and this is one of them.
+              corsFlags.push('--enable-cors');
+            } else if (!hasPeers && dst.startsWith('validator')) {
+              // No "peers", and this is a validator.
+              corsFlags.push('--enable-cors');
+            }
             await needDoRun([
               agoricCli,
               `set-defaults`,
               `ag-chain-cosmos`,
-              `--bootstrap-address=${faucetAddress.trimRight()}`,
               `--persistent-peers=${peers}`,
+              ...corsFlags,
               `--seeds=${seeds}`,
               `--unconditional-peer-ids=${allIds}`,
               ...importFlags,