diff --git a/README.md b/README.md
index d5330f0..cd85a0d 100644
--- a/README.md
+++ b/README.md
@@ -137,6 +137,12 @@ techniques).**
 `ServerName` is the domain you want to make your ISP or firewall _think_ you are visiting. Ideally it should
 match `RedirAddr` in the server's configuration, a major site the censor allows, but it doesn't have to.
 
+`CDNOriginHost` is the domain name of the _origin_ server (i.e. the server running Cloak) under `CDN` mode. This only
+has effect when `Transport` is set to `CDN`. If unset, it will default to the remote hostname supplied via the
+commandline argument (in standalone mode), or by Shadowsocks (in plugin mode). After a TLS session is established with
+the CDN server, this domain name will be used in the HTTP request to ask the CDN server to establish a WebSocket
+connection with this host.
+
 `NumConn` is the amount of underlying TCP connections you want to use. The default of 4 should be appropriate for most
 people. Setting it too high will hinder the performance. Setting it to 0 will disable connection multiplexing and each
 TCP connection will spawn a separate short-lived session that will be closed after it is terminated. This makes it
diff --git a/internal/client/state.go b/internal/client/state.go
index 458b205..f942ad3 100644
--- a/internal/client/state.go
+++ b/internal/client/state.go
@@ -35,6 +35,7 @@ type RawConfig struct {
 	UDP           bool   // nullable
 	BrowserSig    string // nullable
 	Transport     string // nullable
+	CDNOriginHost string // nullable
 	StreamTimeout int    // nullable
 	KeepAlive     int    // nullable
 }
@@ -189,9 +190,16 @@ func (raw *RawConfig) ProcessRawConfig(worldState common.WorldState) (local Loca
 	// Transport and (if TLS mode), browser
 	switch strings.ToLower(raw.Transport) {
 	case "cdn":
+		var cdnDomainPort string
+		if raw.CDNOriginHost == "" {
+			cdnDomainPort = net.JoinHostPort(raw.RemoteHost, raw.RemotePort)
+		} else {
+			cdnDomainPort = net.JoinHostPort(raw.CDNOriginHost, raw.RemotePort)
+		}
+
 		remote.TransportMaker = func() Transport {
 			return &WSOverTLS{
-				cdnDomainPort: remote.RemoteAddr,
+				cdnDomainPort: cdnDomainPort,
 			}
 		}
 	case "direct":