diff --git a/backend/package-lock.json b/backend/package-lock.json
index 0c7f800..008728d 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -8,7 +8,7 @@
       "name": "backend",
       "version": "0.1.0",
       "dependencies": {
-        "@fastify/cors": "^10.1.0",
+        "@fastify/cors": "^11.3.0",
         "@fastify/jwt": "^10.2.2",
         "@fastify/rate-limit": "^11.2.0",
         "@prisma/client": "^6.15.0",
@@ -498,7 +498,9 @@
       }
     },
     "node_modules/@fastify/cors": {
-      "version": "10.1.0",
+      "version": "11.3.0",
+      "resolved": "https://registry.npmjs.org/@fastify/cors/-/cors-11.3.0.tgz",
+      "integrity": "sha512-ggQGua+xHv1MvePbPr0v//xLYEsCXbWspquXCJS9Ot5YoRXq8J8ZWzHnxDBVnbtXosvistXo6LtNzOJswf64Fw==",
       "funding": [
         {
           "type": "github",
@@ -511,8 +513,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "fastify-plugin": "^5.0.0",
-        "mnemonist": "0.40.0"
+        "fastify-plugin": "^6.0.0",
+        "toad-cache": "^3.7.0"
       }
     },
     "node_modules/@fastify/error": {
@@ -583,22 +585,6 @@
         "steed": "^1.1.3"
       }
     },
-    "node_modules/@fastify/jwt/node_modules/fastify-plugin": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
-      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/@fastify/merge-json-schemas": {
       "version": "0.2.1",
       "funding": [
@@ -656,22 +642,6 @@
         "toad-cache": "^3.7.0"
       }
     },
-    "node_modules/@fastify/rate-limit/node_modules/fastify-plugin": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
-      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/@img/colour": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
@@ -2135,7 +2105,9 @@
       }
     },
     "node_modules/fastify-plugin": {
-      "version": "5.1.0",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/fastify-plugin/-/fastify-plugin-6.0.0.tgz",
+      "integrity": "sha512-fZOty7z3O7vOliF6d8bHE3wiEh1KcNnKEQensSgTk9C1DvN6nRLS++XVd86v33Hw/8u9Un8A1zDrQ8ujcQDHEg==",
       "funding": [
         {
           "type": "github",
diff --git a/backend/package.json b/backend/package.json
index f992cab..31e005d 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -17,7 +17,7 @@
     "prisma:deploy": "prisma migrate deploy"
   },
   "dependencies": {
-    "@fastify/cors": "^10.1.0",
+    "@fastify/cors": "^11.3.0",
     "@fastify/jwt": "^10.2.2",
     "@fastify/rate-limit": "^11.2.0",
     "@prisma/client": "^6.15.0",
diff --git a/backend/src/app.ts b/backend/src/app.ts
index 6c08fdf..d54dae8 100644
--- a/backend/src/app.ts
+++ b/backend/src/app.ts
@@ -53,6 +53,8 @@ export function createApp() {
 
   app.register(cors, {
     origin: env.CORS_ORIGIN.length === 1 ? env.CORS_ORIGIN[0] : env.CORS_ORIGIN,
+    // @fastify/cors 11 n'annonce plus par défaut que GET, HEAD et POST : l'API sert aussi PUT, PATCH, DELETE
+    methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
   })
 
   app.register(rateLimit, {
diff --git a/backend/test/api-routes.test.ts b/backend/test/api-routes.test.ts
index 8a97597..e0ea0b7 100644
--- a/backend/test/api-routes.test.ts
+++ b/backend/test/api-routes.test.ts
@@ -582,6 +582,23 @@ describe('Health check', () => {
   })
 })
 
+describe('CORS', () => {
+  it('annonce PUT, PATCH et DELETE dans la réponse de pré-vérification', async () => {
+    const app = createApp()
+
+    const response = await app.inject({
+      method: 'OPTIONS',
+      url: '/trees/tree-1',
+      headers: { origin: 'http://localhost:5173', 'access-control-request-method': 'DELETE' },
+    })
+
+    expect(response.statusCode).toBe(204)
+    expect(response.headers['access-control-allow-origin']).toBe('http://localhost:5173')
+    expect(response.headers['access-control-allow-methods']).toBe('GET,HEAD,PUT,PATCH,POST,DELETE')
+    await app.close()
+  })
+})
+
 describe('Tree CRUD', () => {
   it('creates a tree and returns it', async () => {
     const app = createApp()