diff --git a/module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfiguration.java b/module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfiguration.java
index ec708b9ebfb..f3fd9062378 100644
--- a/module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfiguration.java
+++ b/module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfiguration.java
@@ -180,9 +180,17 @@ public final class GraphQlWebFluxAutoConfiguration {
 		@Bean
 		@ConditionalOnMissingBean
 		GraphQlWebSocketHandler graphQlWebSocketHandler(WebGraphQlHandler webGraphQlHandler,
-				GraphQlProperties properties, ServerCodecConfigurer configurer) {
-			return new GraphQlWebSocketHandler(webGraphQlHandler, configurer,
-					properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive());
+				GraphQlProperties properties, GraphQlCorsProperties corsProperties, ServerCodecConfigurer configurer) {
+			CorsConfiguration corsConfiguration = corsProperties.toCorsConfiguration();
+			if (corsConfiguration != null) {
+				return new GraphQlWebSocketHandler(webGraphQlHandler, configurer,
+						properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive(),
+						corsConfiguration);
+			}
+			else {
+				return new GraphQlWebSocketHandler(webGraphQlHandler, configurer,
+						properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive());
+			}
 		}
 
 		@Bean
diff --git a/module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfiguration.java b/module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfiguration.java
index f1e75dfcc31..e759dd505d7 100644
--- a/module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfiguration.java
+++ b/module/spring-boot-graphql/src/main/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfiguration.java
@@ -186,9 +186,18 @@ public final class GraphQlWebMvcAutoConfiguration {
 		@Bean
 		@ConditionalOnMissingBean
 		GraphQlWebSocketHandler graphQlWebSocketHandler(WebGraphQlHandler webGraphQlHandler,
-				GraphQlProperties properties, ObjectProvider<ServerHttpMessageConvertersCustomizer> customizers) {
-			return new GraphQlWebSocketHandler(webGraphQlHandler, getJsonConverter(customizers),
-					properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive());
+				GraphQlProperties properties, GraphQlCorsProperties corsProperties,
+				ObjectProvider<ServerHttpMessageConvertersCustomizer> customizers) {
+			CorsConfiguration corsConfiguration = corsProperties.toCorsConfiguration();
+			if (corsConfiguration != null) {
+				return new GraphQlWebSocketHandler(webGraphQlHandler, getJsonConverter(customizers),
+						properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive(),
+						corsConfiguration);
+			}
+			else {
+				return new GraphQlWebSocketHandler(webGraphQlHandler, getJsonConverter(customizers),
+						properties.getWebsocket().getConnectionInitTimeout(), properties.getWebsocket().getKeepAlive());
+			}
 		}
 
 		private HttpMessageConverter<Object> getJsonConverter(
diff --git a/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfigurationTests.java b/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfigurationTests.java
index f405e8755a5..535fc239fa0 100644
--- a/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfigurationTests.java
+++ b/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/reactive/GraphQlWebFluxAutoConfigurationTests.java
@@ -22,6 +22,7 @@ import java.util.Map;
 import java.util.function.Consumer;
 
 import graphql.schema.idl.TypeRuntimeWiring;
+import org.assertj.core.api.InstanceOfAssertFactories;
 import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.Test;
 import reactor.core.publisher.Mono;
@@ -263,13 +264,18 @@ class GraphQlWebFluxAutoConfigurationTests {
 	void shouldConfigureWebSocketProperties() {
 		this.contextRunner
 			.withPropertyValues("spring.graphql.websocket.path=/ws",
-					"spring.graphql.websocket.connection-init-timeout=120s", "spring.graphql.websocket.keep-alive=30s")
+					"spring.graphql.websocket.connection-init-timeout=120s", "spring.graphql.websocket.keep-alive=30s",
+					"spring.graphql.cors.allowed-origins=https://example.com")
 			.run((context) -> {
 				assertThat(context).hasSingleBean(GraphQlWebSocketHandler.class);
 				GraphQlWebSocketHandler graphQlWebSocketHandler = context.getBean(GraphQlWebSocketHandler.class);
 				assertThat(graphQlWebSocketHandler).extracting("initTimeoutDuration")
 					.isEqualTo(Duration.ofSeconds(120));
 				assertThat(graphQlWebSocketHandler).extracting("keepAliveDuration").isEqualTo(Duration.ofSeconds(30));
+				assertThat(graphQlWebSocketHandler).extracting("corsConfiguration")
+					.extracting("allowedOrigins")
+					.asInstanceOf(InstanceOfAssertFactories.LIST)
+					.containsExactly("https://example.com");
 			});
 	}
 
diff --git a/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfigurationTests.java b/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfigurationTests.java
index 940ddf07ea4..cf042134ca3 100644
--- a/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfigurationTests.java
+++ b/module/spring-boot-graphql/src/test/java/org/springframework/boot/graphql/autoconfigure/servlet/GraphQlWebMvcAutoConfigurationTests.java
@@ -21,6 +21,7 @@ import java.util.Map;
 import java.util.Optional;
 
 import graphql.schema.idl.TypeRuntimeWiring;
+import org.assertj.core.api.InstanceOfAssertFactories;
 import org.assertj.core.api.ThrowingConsumer;
 import org.junit.jupiter.api.Test;
 
@@ -243,13 +244,18 @@ class GraphQlWebMvcAutoConfigurationTests {
 	void shouldConfigureWebSocketProperties() {
 		this.contextRunner
 			.withPropertyValues("spring.graphql.websocket.path=/ws",
-					"spring.graphql.websocket.connection-init-timeout=120s", "spring.graphql.websocket.keep-alive=30s")
+					"spring.graphql.websocket.connection-init-timeout=120s", "spring.graphql.websocket.keep-alive=30s",
+					"spring.graphql.cors.allowed-origins=https://example.com")
 			.run((context) -> {
 				assertThat(context).hasSingleBean(GraphQlWebSocketHandler.class);
 				GraphQlWebSocketHandler graphQlWebSocketHandler = context.getBean(GraphQlWebSocketHandler.class);
 				assertThat(graphQlWebSocketHandler).extracting("initTimeoutDuration")
 					.isEqualTo(Duration.ofSeconds(120));
 				assertThat(graphQlWebSocketHandler).extracting("keepAliveDuration").isEqualTo(Duration.ofSeconds(30));
+				assertThat(graphQlWebSocketHandler).extracting("corsConfiguration")
+					.extracting("allowedOrigins")
+					.asInstanceOf(InstanceOfAssertFactories.LIST)
+					.containsExactly("https://example.com");
 			});
 	}
 
diff --git a/platform/spring-boot-dependencies/build.gradle b/platform/spring-boot-dependencies/build.gradle
index 7b680822dd1..01a70049bc4 100644
--- a/platform/spring-boot-dependencies/build.gradle
+++ b/platform/spring-boot-dependencies/build.gradle
@@ -2572,7 +2572,7 @@ bom {
 			releaseNotes("https://github.com/spring-projects/spring-framework/releases/tag/v{version}")
 		}
 	}
-	library("Spring GraphQL", "2.0.3") {
+	library("Spring GraphQL", "2.0.4-SNAPSHOT") {
 		considerSnapshots()
 		group("org.springframework.graphql") {
 			modules = [