diff --git a/public/typo3conf/ext/ep_theme/Configuration/TypoScript/Page/Main.typoscript b/public/typo3conf/ext/ep_theme/Configuration/TypoScript/Page/Main.typoscript
index b12f9bfb..42aacca5 100644
--- a/public/typo3conf/ext/ep_theme/Configuration/TypoScript/Page/Main.typoscript
+++ b/public/typo3conf/ext/ep_theme/Configuration/TypoScript/Page/Main.typoscript
@@ -31,6 +31,15 @@ page {
         40.value = ">
     }
 
+    # Every image on the page comes from the CDN host (see Extensions/Replacer.typoscript),
+    # so a cold visitor pays a full DNS + TCP + TLS handshake - measured at 50-70ms - before
+    # the first one can start downloading. `preconnect` gets that out of the way while the
+    # HTML is still parsing. No `crossorigin`: images are fetched without CORS, and an
+    # anonymous-vs-CORS mismatch would open a second connection instead of reusing this one.
+    # Fonts, which would need it, are served by this host now.
+    headerData.100 = TEXT
+    headerData.100.value = <link rel="preconnect" href="https://cdn.ep-reisen.de">
+
     headerData.333 = TEXT
     headerData.333.value (
 <link rel="shortcut icon" type="image/x-icon" href="/typo3conf/ext/ep_theme/Resources/Public/images/favicon.ico">