diff --git a/CHANGES.md b/CHANGES.md
index 2123be0..131b06f 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -7,7 +7,9 @@ but this file may sometimes contain later improvements (e.g. typo fixes).
 
 ## next (not yet released)
 
-No changes yet.
+- Added experimental support for the upcoming `crossorigin` API parameter
+  (added in [Gerrit change I41200852ee][I41200852ee] for [T322944][]).
+  This may be reverted in a future release if the MediaWiki change is not merged after all.
 
 ## v0.8.3 (2024-09-07)
 
@@ -331,3 +333,5 @@ but I see no reason to recreate the tag now.
 [m3api-doc-v0.7.1]: https://lucaswerkmeister.github.io/m3api/v0.7.1/
 [m3api-oauth2]: https://www.npmjs.com/package/m3api-oauth2
 [CVE-2023-45143]: https://github.com/advisories/GHSA-wqq4-5wpv-mx2g
+[I41200852ee]: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/926663
+[T322944]: https://phabricator.wikimedia.org/T322944
diff --git a/core.js b/core.js
index 1e3060a..804e78a 100644
--- a/core.js
+++ b/core.js
@@ -237,7 +237,7 @@ function splitPostParameters( params ) {
 	const urlParams = {};
 	const bodyParams = {};
 	for ( const [ key, value ] of Object.entries( params ) ) {
-		if ( key === 'action' || key === 'origin' ) {
+		if ( key === 'action' || key === 'origin' || key === 'crossorigin' ) {
 			urlParams[ key ] = value;
 		} else {
 			bodyParams[ key ] = value;
diff --git a/test/unit/core.test.js b/test/unit/core.test.js
index 76ff1fb..91e419e 100644
--- a/test/unit/core.test.js
+++ b/test/unit/core.test.js
@@ -1243,6 +1243,24 @@ describe( 'Session', () => {
 
 		} );
 
+		it( 'splits URL and body params', async () => {
+			const session = singleRequestSession( {
+				action: 'query',
+				list: 'search',
+				srsearch: 'test',
+				origin: '*',
+				crossorigin: '',
+			}, {}, 'POST' );
+			await session.request( {
+				action: 'query',
+				list: 'search',
+				srsearch: 'test',
+				origin: '*',
+				crossorigin: true,
+			}, { method: 'POST' } );
+			// actual assertions are in checkPostParams()
+		} );
+
 	} );
 
 	describe( 'requestAndContinue', () => {
diff --git a/test/unit/sessions.js b/test/unit/sessions.js
index dbcdd17..b538e95 100644
--- a/test/unit/sessions.js
+++ b/test/unit/sessions.js
@@ -74,14 +74,27 @@ export function makeResponse( bodyOrResponse ) {
 	}
 }
 
+/**
+ * Check that the URL and body parameters are disjoint,
+ * that the URL parameters only include action/origin/crossorigin
+ * and that the body paramaters don’t include those parameters.
+ *
+ * @param {Object} urlParams
+ * @param {Object} bodyParams
+ */
 function checkPostParams( urlParams, bodyParams ) {
 	const urlParamNames = Object.keys( urlParams );
 	const commonParamNames = urlParamNames.filter(
 		( name ) => name in bodyParams );
 	expect( commonParamNames ).to.be.empty;
+
 	const unexpectedUrlParamNames = urlParamNames.filter(
-		( name ) => name !== 'action' && name !== 'origin' );
+		( name ) => name !== 'action' && name !== 'origin' && name !== 'crossorigin' );
 	expect( unexpectedUrlParamNames ).to.be.empty;
+
+	expect( bodyParams ).not.to.have.keys( 'action' );
+	expect( bodyParams ).not.to.have.keys( 'origin' );
+	expect( bodyParams ).not.to.have.keys( 'crossorigin' );
 }
 
 /**