diff --git a/gate-core/src/main/groovy/com/netflix/spinnaker/gate/filters/CorsFilter.groovy b/gate-core/src/main/groovy/com/netflix/spinnaker/gate/filters/CorsFilter.groovy
index 27cbd48c65..1887c5b0c5 100644
--- a/gate-core/src/main/groovy/com/netflix/spinnaker/gate/filters/CorsFilter.groovy
+++ b/gate-core/src/main/groovy/com/netflix/spinnaker/gate/filters/CorsFilter.groovy
@@ -55,7 +55,7 @@ class CorsFilter implements Filter {
     response.setHeader("Access-Control-Allow-Origin", origin)
     response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT, PATCH")
     response.setHeader("Access-Control-Max-Age", "3600")
-    response.setHeader("Access-Control-Allow-Headers", "x-requested-with, content-type, authorization, X-RateLimit-App, X-Spinnaker-Priority")
+    response.setHeader("Access-Control-Allow-Headers", "x-requested-with, content-type, authorization, X-RateLimit-App, X-Spinnaker-Priority, Content-Disposition")
     response.setHeader("Access-Control-Expose-Headers", [Headers.AUTHENTICATION_REDIRECT_HEADER_NAME].join(", "))
     chain.doFilter(req, res)
   }
diff --git a/gate-web/src/main/groovy/com/netflix/spinnaker/gate/controllers/OpsmxAutopilotController.groovy b/gate-web/src/main/groovy/com/netflix/spinnaker/gate/controllers/OpsmxAutopilotController.groovy
index f96b01372a..f1f59205a8 100644
--- a/gate-web/src/main/groovy/com/netflix/spinnaker/gate/controllers/OpsmxAutopilotController.groovy
+++ b/gate-web/src/main/groovy/com/netflix/spinnaker/gate/controllers/OpsmxAutopilotController.groovy
@@ -29,10 +29,14 @@ import okhttp3.Request
 import org.apache.commons.io.IOUtils
 import org.springframework.beans.factory.annotation.Autowired
 import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression
+import org.springframework.http.HttpHeaders
+import org.springframework.http.ResponseEntity
 import org.springframework.web.bind.annotation.*
 import org.springframework.web.multipart.MultipartFile
 import retrofit.client.Response
 
+import java.util.stream.Collectors
+
 @RequestMapping("/autopilot")
 @RestController
 @Slf4j
@@ -70,7 +74,10 @@ class OpsmxAutopilotController {
     InputStream inputStream = response.getBody().in()
     try {
       byte [] zipFile = IOUtils.toByteArray(inputStream)
-      return zipFile
+      HttpHeaders headers = new HttpHeaders()
+      headers.add("Content-Disposition", response.getHeaders().stream().filter({ header -> header.getName().trim().equalsIgnoreCase("Content-Disposition") }).collect(Collectors.toList()).get(0).value)
+      return ResponseEntity.ok().headers(headers).body(zipFile)
+      
     } finally{
       if (inputStream!=null){
         inputStream.close()