diff --git a/ansible/roles/glance/templates/glance-api.conf.j2 b/ansible/roles/glance/templates/glance-api.conf.j2
index 9f892c5d2686831afddf1dac4fd698cfda65e164..9f603a7150d61abdf58d5951d24686a3e3f7c9eb 100644
--- a/ansible/roles/glance/templates/glance-api.conf.j2
+++ b/ansible/roles/glance/templates/glance-api.conf.j2
@@ -151,3 +151,6 @@ auth_endpoint = {{ keystone_internal_url }}
 barbican_endpoint_type = internal
 verify_ssl_path = {{ openstack_cacert }}
 {% endif %}
+
+[cors]
+allowed_origin = {{ horizon_public_endpoint }}
diff --git a/ansible/roles/horizon/templates/local_settings.j2 b/ansible/roles/horizon/templates/local_settings.j2
index b4fbbf99d5d1fe02f83ad2c4e927fee43911f891..7e47a5cfe96ceeeb976b82b8b1d6add3a6d5c358 100644
--- a/ansible/roles/horizon/templates/local_settings.j2
+++ b/ansible/roles/horizon/templates/local_settings.j2
@@ -415,7 +415,7 @@ IMAGE_RESERVED_CUSTOM_PROPERTIES = []
 # Horizon server. When enabled, a file form field will appear on the create
 # image form. If set to 'off', there will be no file form field on the create
 # image form. See documentation for deployment considerations.
-#HORIZON_IMAGES_UPLOAD_MODE = 'legacy'
+HORIZON_IMAGES_UPLOAD_MODE = 'direct'
 
 # OPENSTACK_ENDPOINT_TYPE specifies the endpoint type to use for the endpoints
 # in the Keystone service catalog. Use this setting when Horizon is running
diff --git a/releasenotes/notes/horizon-image-upload-direct-5a697772e5f8c4b3.yaml b/releasenotes/notes/horizon-image-upload-direct-5a697772e5f8c4b3.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..de11f7f5cb7a69edf187e1093c7d7b0e7a87dad2
--- /dev/null
+++ b/releasenotes/notes/horizon-image-upload-direct-5a697772e5f8c4b3.yaml
@@ -0,0 +1,13 @@
+---
+features:
+  - |
+    ``HORIZON_IMAGES_UPLOAD_MODE`` is now set to ``'direct'`` by default.
+    This improves image uploads from clients, because these no longer use
+    Horizon's webserver as a staging area - the image upload goes directly
+    to Glance API.
+upgrade:
+  - |
+    ``HORIZON_IMAGES_UPLOAD_MODE`` is now set to ``'direct'`` by default.
+    In order to retain the previous default (``'legacy'``) - please
+    set ``HORIZON_IMAGES_UPLOAD_MODE: 'legacy'`` in your
+    ``custom_local_settings`` file.