diff --git a/src/app/layout.tsx b/src/app/layout.tsx
index d401adc6..4c17e554 100644
--- a/src/app/layout.tsx
+++ b/src/app/layout.tsx
@@ -6,6 +6,7 @@ import NextTopLoader from "nextjs-toploader";
 import { IBM_Plex_Sans } from "next/font/google";
 import { S3CredentialsProvider, UploadProvider } from "@/components";
 import { metadata } from "./metadata";
+import { CONFIG } from "@/lib/config";
 const ibmPlexSans = IBM_Plex_Sans({
   subsets: ["latin"],
   weight: ["400", "500", "600", "700"],
@@ -22,6 +23,18 @@ export default async function RootLayout({ children }: RootLayoutProps) {
   return (
     <html lang="en" suppressHydrationWarning>
       <body className={ibmPlexSans.variable} suppressHydrationWarning>
+        {/* ponytail: cross-origin hosts on the critical path. Both are discovered
+            late — the fonts only once globals.css parses — so the handshake
+            otherwise starts cold. crossOrigin on the font host only: fonts are
+            fetched in CORS mode, the Ory session request is credentialed. */}
+        <link
+          rel="preconnect"
+          href="https://assets.radiant.earth"
+          crossOrigin=""
+        />
+        {CONFIG.auth.api.backendUrl && (
+          <link rel="preconnect" href={CONFIG.auth.api.backendUrl} />
+        )}
         <ThemeProvider
           attribute="class"
           enableSystem={true}
