diff --git a/api/obs/api/app.py b/api/obs/api/app.py
index 0fe34e2..c378c42 100644
--- a/api/obs/api/app.py
+++ b/api/obs/api/app.py
@@ -101,6 +101,7 @@ def setup_cors(app):
         app,
         origins=origins,
         supports_credentials=True,
+        expose_headers={"Content-Disposition"},
     )
 
 
diff --git a/api/obs/api/routes/tracks.py b/api/obs/api/routes/tracks.py
index 6abe794..d2cdbef 100644
--- a/api/obs/api/routes/tracks.py
+++ b/api/obs/api/routes/tracks.py
@@ -207,7 +207,11 @@ async def download_original_file(req, slug: str):
     if not track.is_visible_to_private(req.ctx.user):
         raise Forbidden()
 
-    return await file_stream(track.get_original_file_path(req.app.config))
+    return await file_stream(
+        track.get_original_file_path(req.app.config),
+        mime_type="text/csv",
+        filename=f"{slug}.csv",
+    )
 
 
 @api.put("/tracks/<slug:str>")