diff --git a/middleware/originGuard.middleware.js b/middleware/originGuard.middleware.js
index c638185..beeca32 100644
--- a/middleware/originGuard.middleware.js
+++ b/middleware/originGuard.middleware.js
@@ -88,6 +88,11 @@ const VALID_FETCH_COMBOS = new Set([
   'cors|empty',         // standard fetch() from cross-origin SPA
   'same-origin|empty',  // same-origin fetch()
   'navigate|document',  // direct browser navigation to an API URL
+  'no-cors|image',      // <img src="..."> loading a media/asset route
+  'no-cors|video',      // <video src="..."> / <source> streaming a media route
+  'no-cors|audio',      // <audio src="...">
+  'no-cors|font',       // @font-face url() cross-origin font fetch
+  'no-cors|track',      // <track src="..."> (video subtitle/caption tracks)
 ]);
 
 module.exports = function originGuard(req, res, next) {