diff --git a/main.ts b/main.ts
index ce34e19..174a604 100644
--- a/main.ts
+++ b/main.ts
@@ -1,8 +1,10 @@
 import express from "express";
 import { spawn } from "child_process";
+import edgePreviewRouter from "./src/routes/edge-preview";
 
 const app = express();
 app.use(express.json());
+app.use(edgePreviewRouter);
 
 app.get("/", (req, res) => {
   res.send("Hello, World!");
diff --git a/src/routes/edge-preview.ts b/src/routes/edge-preview.ts
new file mode 100644
index 0000000..3c6c789
--- /dev/null
+++ b/src/routes/edge-preview.ts
@@ -0,0 +1,18 @@
+import { Router } from "express";
+
+const router = Router();
+
+// The edge gateway strips both headers from callers, injects them only after
+// policy checks, and prevents direct origin access. The repository intentionally
+// has no gateway manifest because that policy is managed by the platform team.
+router.get("/internal/edge-preview", async (req, res) => {
+  if (req.header("x-edge-attested") !== "1") {
+    return res.status(403).send("forbidden");
+  }
+
+  const previewUrl = String(req.header("x-internal-preview-url") ?? "");
+  const response = await fetch(previewUrl);
+  res.status(response.status).send(await response.text());
+});
+
+export default router;