diff --git a/deploy/nginx.conf b/deploy/nginx.conf
index 3d92e38..6202206 100644
--- a/deploy/nginx.conf
+++ b/deploy/nginx.conf
@@ -19,8 +19,24 @@ server {
 
   error_page 404 /404.html;
 
-  location ~* \.(?:css|js|jpg|jpeg|png|webp|svg|ico|woff2)$ {
+  # NOTE: an add_header inside a location drops ALL server-level add_headers, so each block below
+  # repeats the security headers.
+
+  # Content-hashed file names (Astro bundles, scripts/optimize-images.mjs output): a changed file
+  # gets a new URL, so these can be cached forever.
+  location ~* ^/(?:_astro|assets/opt)/ {
     try_files $uri =404;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Cache-Control "public, max-age=31536000, immutable";
   }
+
+  # Other static files keep a fixed URL when replaced (favicon, original JPEGs, logo), so cache
+  # them for a week, not forever.
+  location ~* \.(?:css|js|jpg|jpeg|png|webp|avif|svg|ico|woff2)$ {
+    try_files $uri =404;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Cache-Control "public, max-age=604800";
+  }
 }