diff --git a/frontend/public/_headers b/frontend/public/_headers
new file mode 100644
index 00000000..ec46c8e6
--- /dev/null
+++ b/frontend/public/_headers
@@ -0,0 +1,9 @@
+/*
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=()
+  Strict-Transport-Security: max-age=31536000; includeSubDomains
+
+/assets/*
+  Cache-Control: public, max-age=31536000, immutable
diff --git a/frontend/public/assets/404.html b/frontend/public/assets/404.html
new file mode 100644
index 00000000..316ff066
--- /dev/null
+++ b/frontend/public/assets/404.html
@@ -0,0 +1,3 @@
+<!doctype html>
+<!-- In assets/ so only missing assets 404; a root 404.html disables SPA fallback -->
+<title>Not found</title>
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index 55071fba..91cd8ea0 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -114,6 +114,9 @@ export default defineConfig(({ mode }) => {
       },
       target: "es2022",
       minify: "terser",
+      terserOptions: {
+        ecma: 2020,
+      },
       sourcemap: false,
     },
   };