diff --git a/README.md b/README.md
index 01a809e..b236764 100644
--- a/README.md
+++ b/README.md
@@ -84,6 +84,10 @@ The ``startup.sh`` script allows some customization on startup:
   * ``CORS_ALLOW_CREDENTIALS`` (default ``false``) **Setting this to ``true`` will only have the desired effect if ``CORS_ALLOWED_ORIGINS`` defines explicit origins (not ``*``)**
 * ``PROXY_BASE_URL`` to the base URL of the GeoServer web app if GeoServer is behind a proxy. Example: ``https://example.com/geoserver``.
 
+The CORS variables customize tomcat's `web.xml` file. If you need more customization, 
+you can provide your own customized `web.xml` file to tomcat by mounting it into the container 
+at `/opt/config_overrides/web.xml`.
+
 Example installing wps and ysld extensions:
 
 ```shell
diff --git a/startup.sh b/startup.sh
index 182e9c0..5e76d30 100755
--- a/startup.sh
+++ b/startup.sh
@@ -121,6 +121,17 @@ fi
 # Use a custom "server.xml" if the user mounted one into the container
 copy_custom_config server.xml
 
+# Use a custom "web.xml" if the user mounted one into the container
+if [ -d "${CONFIG_OVERRIDES_DIR}" ] && [ -f "${CONFIG_OVERRIDES_DIR}/web.xml" ]; then
+  echo "Installing configuration override for web.xml with substituted environment variables"
+  
+  if [ "${CORS_ENABLED}" = "true" ]; then 
+    echo "Warning: the CORS_ENABLED's changes will be overwritten!"
+  fi
+  
+  envsubst < "${CONFIG_OVERRIDES_DIR}"/web.xml > "${CATALINA_HOME}/webapps/geoserver/WEB-INF/web.xml"
+fi
+
 # start the tomcat
 # CIS - Tomcat Benchmark recommendations:
 # * Turn off session facade recycling