diff --git a/datasette/utils/asgi.py b/datasette/utils/asgi.py
index 911038ab..bd388390 100644
--- a/datasette/utils/asgi.py
+++ b/datasette/utils/asgi.py
@@ -247,9 +247,9 @@ async def asgi_start(send, status, headers=None, content_type="text/plain"):
 
 
 async def asgi_send_file(
-    send, filepath, filename=None, content_type=None, chunk_size=4096
+    send, filepath, filename=None, content_type=None, chunk_size=4096, headers=None
 ):
-    headers = {}
+    headers = headers or {}
     if filename:
         headers["content-disposition"] = 'attachment; filename="{}"'.format(filename)
     first = True
@@ -395,13 +395,22 @@ class Response:
 
 class AsgiFileDownload:
     def __init__(
-        self, filepath, filename=None, content_type="application/octet-stream"
+        self,
+        filepath,
+        filename=None,
+        content_type="application/octet-stream",
+        headers=None,
     ):
+        self.headers = headers or {}
         self.filepath = filepath
         self.filename = filename
         self.content_type = content_type
 
     async def asgi_send(self, send):
         return await asgi_send_file(
-            send, self.filepath, filename=self.filename, content_type=self.content_type
+            send,
+            self.filepath,
+            filename=self.filename,
+            content_type=self.content_type,
+            headers=self.headers,
         )
diff --git a/datasette/views/database.py b/datasette/views/database.py
index 74509278..025e853d 100644
--- a/datasette/views/database.py
+++ b/datasette/views/database.py
@@ -144,10 +144,14 @@ class DatabaseDownload(DataView):
         if not db.path:
             raise DatasetteError("Cannot download database", status=404)
         filepath = db.path
+        headers = {}
+        if self.ds.cors:
+            headers["Access-Control-Allow-Origin"] = "*"
         return AsgiFileDownload(
             filepath,
             filename=os.path.basename(filepath),
             content_type="application/octet-stream",
+            headers=headers,
         )
 
 
diff --git a/tests/fixtures.py b/tests/fixtures.py
index d8c92561..7786ca8c 100644
--- a/tests/fixtures.py
+++ b/tests/fixtures.py
@@ -227,7 +227,7 @@ def app_client_with_dot():
 
 @pytest.fixture(scope="session")
 def app_client_with_cors():
-    with make_app_client(cors=True) as client:
+    with make_app_client(is_immutable=True, cors=True) as client:
         yield client
 
 
diff --git a/tests/test_api.py b/tests/test_api.py
index 1d454ea1..461d3f81 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -1739,6 +1739,7 @@ def test_trace(app_client):
 @pytest.mark.parametrize(
     "path,status_code",
     [
+        ("/fixtures.db", 200),
         ("/fixtures.json", 200),
         ("/fixtures/no_primary_key.json", 200),
         # A 400 invalid SQL query should still have the header: