diff --git a/.circleci/config.yml b/.circleci/config.yml
index 92df7673..4878a6fe 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -83,7 +83,7 @@ workflows:
           branches:
             only:
             - dev
-            - fix/floating-point-arhithmetic
+            - fix/plat-2985
 
     - "build-qa":
         context: org-global
diff --git a/app.js b/app.js
index 72bc3362..c72672f2 100644
--- a/app.js
+++ b/app.js
@@ -34,6 +34,14 @@ app.use("/v5/challenges/docs", swaggerUi.serve, swaggerUi.setup(challengeAPISwag
 
 app.use(
   cors({
+    origin: (origin, callback) => {
+      if (!origin) {
+        // disable cors if service to service request
+        callback(null, false);
+      } else {
+        callback(null, new RegExp(/topcoder(-dev|-qa)?\.com$/));
+      }
+    },
     exposedHeaders: [
       "X-Prev-Page",
       "X-Next-Page",
diff --git a/package.json b/package.json
index c6cdb098..91ecffa4 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "bluebird": "^3.5.1",
     "body-parser": "^1.15.1",
     "config": "^3.0.1",
-    "cors": "^2.7.1",
+    "cors": "^2.8.5",
     "decimal.js": "^10.4.3",
     "deep-equal": "^2.2.0",
     "dotenv": "^8.2.0",
diff --git a/yarn.lock b/yarn.lock
index c2a451ca..c3204cbb 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -979,7 +979,7 @@ core-util-is@~1.0.0:
   resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.3.tgz#a6042d3634c2b27e9328f837b965fac83808db85"
   integrity sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==
 
-cors@^2.7.1:
+cors@^2.8.5:
   version "2.8.5"
   resolved "https://registry.yarnpkg.com/cors/-/cors-2.8.5.tgz#eac11da51592dd86b9f06f6e7ac293b3df875d29"
   integrity sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==