diff --git a/.changeset/wicked-knives-wink.md b/.changeset/wicked-knives-wink.md
new file mode 100644
index 0000000000..e0f3e485c0
--- /dev/null
+++ b/.changeset/wicked-knives-wink.md
@@ -0,0 +1,14 @@
+---
+'@backstage/create-app': patch
+---
+
+Add `PATCH` and `HEAD` to the `Access-Control-Allow-Methods`.
+
+To apply this change to your Backstage installation make the following change to your `app-config.yaml`
+
+```diff
+   cors:
+     origin: http://localhost:3000
+-    methods: [GET, POST, PUT, DELETE]
++    methods: [GET, POST, PUT, DELETE, PATCH, HEAD]
+```
diff --git a/app-config.yaml b/app-config.yaml
index cb865a52b9..32b53da236 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -39,7 +39,7 @@ backend:
     store: memory
   cors:
     origin: http://localhost:3000
-    methods: [GET, POST, PUT, DELETE]
+    methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
     credentials: true
   csp:
     connect-src: ["'self'", 'http:', 'https:']
diff --git a/packages/create-app/templates/default-app/app-config.yaml.hbs b/packages/create-app/templates/default-app/app-config.yaml.hbs
index cd6998de69..9c31ccf381 100644
--- a/packages/create-app/templates/default-app/app-config.yaml.hbs
+++ b/packages/create-app/templates/default-app/app-config.yaml.hbs
@@ -24,7 +24,7 @@ backend:
     # Default Helmet Content-Security-Policy values can be removed by setting the key to false
   cors:
     origin: http://localhost:3000
-    methods: [GET, POST, PUT, DELETE]
+    methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
     credentials: true
   # This is for local developement only, it is not recommended to use this in production
   # The production database configuration is stored in app-config.production.yaml