diff --git a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
index eb046f380e..2170a2b501 100644
--- a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
@@ -796,7 +796,11 @@
 								{ name: 'Authentication', active: authentication_method !== 'none' },
 								{
 									name: 'CORS',
-									active: isOriginRestricted(allowed_origins, instanceDefaultOrigins)
+									// Not shown for a static route: the backend exempts those from
+									// the allowlist, so reporting a restriction would be a lie.
+									active:
+										!static_asset_config &&
+										isOriginRestricted(allowed_origins, instanceDefaultOrigins)
 								}
 							]}
 						/>
@@ -1001,13 +1005,20 @@
 										{testingBadge}
 									/>
 
-									<RouteCorsOption
-										bind:allowed_origins
-										error={originsError}
-										{instanceDefaultOrigins}
-										disabled={!can_write}
-										{testingBadge}
-									/>
+									<!-- Both static target types are exempt from the allowlist on
+										 the backend, so the control is not offered for either. The
+										 surrounding section is only hidden for a static website,
+										 which would leave a single-file static asset showing a
+										 restriction that is never applied. -->
+									{#if !static_asset_config}
+										<RouteCorsOption
+											bind:allowed_origins
+											error={originsError}
+											{instanceDefaultOrigins}
+											disabled={!can_write}
+											{testingBadge}
+										/>
+									{/if}
 								</div>
 							{:else}
 								<TriggerRetriesAndErrorHandler