diff --git a/packages/wp/wp/App/Rest/AllPoints.php b/packages/wp/wp/App/Rest/AllPoints.php
index a24fb74..d3694ae 100644
--- a/packages/wp/wp/App/Rest/AllPoints.php
+++ b/packages/wp/wp/App/Rest/AllPoints.php
@@ -71,9 +71,26 @@ public function init() {
 
 		if ( class_exists( 'WP_REST_Server' ) ) {
 			\add_action( 'rest_api_init', array( $this, 'add_plugin_rest_api' ) );
+			\add_filter( 'rest_allowed_cors_headers', array( $this, 'allow_figma_connection_header' ) );
 		}
 	}
 
+	/**
+	 * Allow the authentication header used by the Figma plugin.
+	 *
+	 * Figma plugin requests use a null origin and trigger a CORS preflight.
+	 * WordPress allows that origin by default, but custom request headers must
+	 * be added to the REST API allowlist explicitly.
+	 *
+	 * @param string[] $allow_headers REST request headers allowed by CORS.
+	 * @return string[]
+	 */
+	public function allow_figma_connection_header( array $allow_headers ): array {
+		$allow_headers[] = 'X-Core-Framework-Key';
+
+		return array_values( array_unique( $allow_headers ) );
+	}
+
 	/**
 	 * @since 0.0.0
 	 */
diff --git a/scripts/test-wp-e2e.sh b/scripts/test-wp-e2e.sh
index 1cff133..11030f8 100755
--- a/scripts/test-wp-e2e.sh
+++ b/scripts/test-wp-e2e.sh
@@ -114,6 +114,8 @@ wp_cli core install \
 	--admin_email=e2e@example.test \
 	--skip-email
 
+wp_cli rewrite structure '/%postname%/' --hard
+
 for option_name in \
 	core_framework_free_license \
 	core_framework_bricks_license_key \
@@ -225,6 +227,22 @@ if ($deleted->is_error() || get_option("core_framework_api_key", "") !== "") {
 WP_CLI::success("REST authorization and Figma connection-key lifecycle passed.");
 '
 
+FIGMA_PREFLIGHT_HEADERS="$(curl --fail --silent --show-error --dump-header - --output /dev/null \
+	--request OPTIONS "$SITE_URL/wp-json/core-framework/v2/preset" \
+	--header 'Origin: null' \
+	--header 'Access-Control-Request-Method: GET' \
+	--header 'Access-Control-Request-Headers: content-type,x-core-framework-key')"
+
+if ! grep -Eqi '^Access-Control-Allow-Origin:[[:space:]]*null' <<<"$FIGMA_PREFLIGHT_HEADERS"; then
+	echo "The Figma REST preflight did not allow Figma's null origin." >&2
+	exit 1
+fi
+
+if ! grep -Eqi '^Access-Control-Allow-Headers:.*X-Core-Framework-Key' <<<"$FIGMA_PREFLIGHT_HEADERS"; then
+	echo "The Figma REST preflight did not allow the X-Core-Framework-Key header." >&2
+	exit 1
+fi
+
 wp_cli plugin deactivate core-framework --quiet
 [[ "$(wp_cli plugin get core-framework --field=status)" == "inactive" ]]
 wp_cli plugin activate core-framework --quiet