diff --git a/packages/server/package.json b/packages/server/package.json
index 210fc66c0..4bf77f9b2 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -25,7 +25,7 @@
     "@fortawesome/fontawesome-free": "5.15.4",
     "@joplin/lib": "~2.11",
     "@joplin/renderer": "~2.11",
-    "@koa/cors": "4.0.0",
+    "@koa/cors": "3.4.3",
     "@types/uuid": "9.0.1",
     "bcryptjs": "2.4.3",
     "bulma": "0.9.4",
diff --git a/renovate.json5 b/renovate.json5
index c9868065c..3dbb4fe15 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -123,6 +123,10 @@
 		"pretty-bytes",
 		"strip-ansi",
 
+		// @koa/cors has undocumented breaking changes, and the package is not
+		// well supported so we're stuck with latest v3 for now
+		"@koa/cors",
+
 		// Can't upgrade beyond 2.x because it doesn't work with Electron. If trying to
 		// upgrade again, check that adding a link from the CodeMirror editor works.
 		// See /packages/app-desktop/gui/dialogs.ts
diff --git a/yarn.lock b/yarn.lock
index d2785e89e..1366ffc5d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4710,7 +4710,7 @@ __metadata:
     "@joplin/lib": ~2.11
     "@joplin/renderer": ~2.11
     "@joplin/tools": ~2.11
-    "@koa/cors": 4.0.0
+    "@koa/cors": 3.4.3
     "@rmp135/sql-ts": 1.16.0
     "@types/formidable": 2.0.6
     "@types/fs-extra": 11.0.1
@@ -4952,12 +4952,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@koa/cors@npm:4.0.0":
-  version: 4.0.0
-  resolution: "@koa/cors@npm:4.0.0"
+"@koa/cors@npm:3.4.3":
+  version: 3.4.3
+  resolution: "@koa/cors@npm:3.4.3"
   dependencies:
     vary: ^1.1.2
-  checksum: e0760544823532f2d71d792e3076858e38bab9b1c090abea175f1319fd91ea58a1da384a2fe7f5108f1c681e3830b01f62a1cafe271d6406751976af443187aa
+  checksum: 51a5b89b4ea19078272ea2702916c90375853b6cfb9b65bf7720653e99b36950c1fd90df66a77fb17839bb130dc7c9f83ccc0bcec40f9d09769f9ed77ced5f23
   languageName: node
   linkType: hard