diff --git a/conf.d/bbaovanc.com b/conf.d/bbaovanc.com
index 6851b47..42c4f0f 100644
--- a/conf.d/bbaovanc.com
+++ b/conf.d/bbaovanc.com
@@ -20,6 +20,8 @@ bbaovanc.com {
     redir /categories/tinkering/ /categories/experiments/
 
     header Cache-Control no-cache
+    header X-Content-Type-Options nosniff
+
     root * /var/www/bbaovanc.com/public
     file_server {
         precompressed br zstd gzip
diff --git a/conf.d/demo.bbaovanc.com b/conf.d/demo.bbaovanc.com
index b6cf94d..3d2b525 100644
--- a/conf.d/demo.bbaovanc.com
+++ b/conf.d/demo.bbaovanc.com
@@ -19,7 +19,9 @@ demo.bbaovanc.com {
 
     handle /staging/* {
         header Cache-Control no-cache
+        header X-Content-Type-Options nosniff
         header boba-handle staging
+
         file_server {
             precompressed br zstd gzip
         }