diff --git a/tests/test_cors.py b/tests/test_cors.py
new file mode 100644
index 0000000..02565e7
--- /dev/null
+++ b/tests/test_cors.py
@@ -0,0 +1,19 @@
+from typing import TYPE_CHECKING
+
+
+if TYPE_CHECKING:
+    from httpx import AsyncClient
+
+
+async def test_cors_preflight_allows_write_methods(client: AsyncClient) -> None:
+    response = await client.options(
+        "/api/decks/",
+        headers={
+            "Origin": "http://localhost:5173",
+            "Access-Control-Request-Method": "POST",
+        },
+    )
+
+    allow_methods = response.headers.get("access-control-allow-methods", "")
+    assert "POST" in allow_methods
+    assert "PUT" in allow_methods