diff --git a/crates/cli/src/commands/cors.rs b/crates/cli/src/commands/cors.rs
index 06dda15..78c9081 100644
--- a/crates/cli/src/commands/cors.rs
+++ b/crates/cli/src/commands/cors.rs
@@ -679,6 +679,28 @@ mod tests {
         assert_eq!(config.rules[0].allowed_methods, vec!["GET".to_string()]);
     }
 
+    #[test]
+    fn test_parse_cors_configuration_xml_drops_blank_optional_headers() {
+        let config = parse_cors_configuration(
+            r#"
+<CORSConfiguration>
+  <CORSRule>
+    <AllowedOrigin>https://console.example.com</AllowedOrigin>
+    <AllowedMethod>get</AllowedMethod>
+    <AllowedHeader>   </AllowedHeader>
+    <ExposeHeader></ExposeHeader>
+  </CORSRule>
+</CORSConfiguration>
+"#,
+        )
+        .expect("parse xml config with blank optional headers");
+
+        assert_eq!(config.rules.len(), 1);
+        assert_eq!(config.rules[0].allowed_headers, None);
+        assert_eq!(config.rules[0].expose_headers, None);
+        assert_eq!(config.rules[0].allowed_methods, vec!["GET".to_string()]);
+    }
+
     #[test]
     fn test_cors_input_source_prefers_positional_argument() {
         let args = SetCorsArgs {
diff --git a/crates/cli/src/commands/mod.rs b/crates/cli/src/commands/mod.rs
index 1c9532f..12166b5 100644
--- a/crates/cli/src/commands/mod.rs
+++ b/crates/cli/src/commands/mod.rs
@@ -439,6 +439,19 @@ mod tests {
         }
     }
 
+    #[test]
+    fn cli_accepts_top_level_cors_get_alias() {
+        let cli = Cli::try_parse_from(["rc", "cors", "get", "local/my-bucket"])
+            .expect("parse top-level cors get");
+
+        match cli.command {
+            Commands::Cors(cors::CorsCommands::List(arg)) => {
+                assert_eq!(arg.path, "local/my-bucket");
+            }
+            other => panic!("expected top-level cors get alias, got {:?}", other),
+        }
+    }
+
     #[test]
     fn cli_accepts_bucket_cors_get_alias() {
         let cli = Cli::try_parse_from(["rc", "bucket", "cors", "get", "local/my-bucket"])