diff --git a/app/Controllers/EmployeeRestController.php b/app/Controllers/EmployeeRestController.php
index 4ddd32a7..4c572897 100755
--- a/app/Controllers/EmployeeRestController.php
+++ b/app/Controllers/EmployeeRestController.php
@@ -808,13 +808,17 @@ class EmployeeRestController extends AdminController
             $policyName = preg_replace('/[^A-Za-z0-9_\- ]/', '', (string) ($empData[0]['policy_name'] ?? 'Employees'));
             $filename   = trim($policyName) !== '' ? $policyName . '-Employees.xlsx' : 'Employees.xlsx';
 
-            header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
-            header('Content-Disposition: attachment;filename="' . $filename . '"');
-            header('Cache-Control: max-age=0');
-
+            // Return via CI Response (no header()/exit) so global Cors after-filter can attach ACAO headers.
             $writer = new Xlsx($spreadsheet);
+            ob_start();
             $writer->save('php://output');
-            exit;
+            $content = ob_get_clean();
+
+            return $this->response
+                ->setHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet')
+                ->setHeader('Content-Disposition', 'attachment;filename="' . $filename . '"')
+                ->setHeader('Cache-Control', 'max-age=0')
+                ->setBody($content);
         } catch (\Exception $e) {
             return $this->respond(['status' => 'failed', 'code' => 500, 'data' => $e->getMessage()], 500);
         }