diff --git a/apps/ops/src/components/shared/TaskNode.vue b/apps/ops/src/components/shared/TaskNode.vue
index 6c3a65f..20204d1 100644
--- a/apps/ops/src/components/shared/TaskNode.vue
+++ b/apps/ops/src/components/shared/TaskNode.vue
@@ -329,10 +329,13 @@ function confirmDelete () {
     persistent: true,
   }).onOk(async () => {
     try {
+      // NB: no `credentials: 'include'` — the hub responds with
+      // `Access-Control-Allow-Origin: *`, and that combination is forbidden
+      // by the CORS spec (browsers reject the preflight as NetworkError).
+      // Every other hub call in this SPA follows the same pattern.
       const res = await fetch(`${HUB_URL}/dispatch/job-delete`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        credentials: 'include',
         body: JSON.stringify({ job: props.job.name }),
       })
       const body = await res.json().catch(() => ({}))