diff --git a/frontend/nginx.conf b/frontend/nginx.conf
index db5cb9b..579e326 100644
--- a/frontend/nginx.conf
+++ b/frontend/nginx.conf
@@ -5,6 +5,8 @@ upstream web {
 server {
   listen 80;
 
+  add_header X-Content-Type-Options "nosniff" always;
+
   location ~ ^/api(/?)(.*) {
     proxy_pass http://web/$2$is_args$args;
   }
diff --git a/widget/nginx.conf b/widget/nginx.conf
index d64c1a5..4b6c394 100644
--- a/widget/nginx.conf
+++ b/widget/nginx.conf
@@ -1,6 +1,8 @@
 server {
   listen 80;
 
+  add_header X-Content-Type-Options "nosniff" always;
+
   location / {
     root /usr/share/nginx/html/;
     include /etc/nginx/mime.types;