diff --git a/apps/web/next.config.mjs b/apps/web/next.config.mjs
index 657f6a3bba..ce8e40d173 100644
--- a/apps/web/next.config.mjs
+++ b/apps/web/next.config.mjs
@@ -96,6 +96,23 @@ const nextConfig = {
 			},
 		].filter(Boolean),
 	},
+	async headers() {
+		return [
+			{
+				source: "/(.*)",
+				headers: [
+					{ key: "X-Content-Type-Options", value: "nosniff" },
+					{ key: "X-DNS-Prefetch-Control", value: "off" },
+				],
+			},
+			{
+				source: "/((?!api/auth/).*)",
+				headers: [
+					{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+				],
+			},
+		];
+	},
 	async rewrites() {
 		return [
 			{