diff --git a/solitaire_server/src/lib.rs b/solitaire_server/src/lib.rs
index 4120aae..4d06791 100644
--- a/solitaire_server/src/lib.rs
+++ b/solitaire_server/src/lib.rs
@@ -267,6 +267,14 @@ async fn security_headers(req: Request<axum::body::Body>, next: axum_middleware:
         HeaderValue::from_static("nosniff"),
     );
     headers.insert("X-Frame-Options", HeaderValue::from_static("DENY"));
+    // Force revalidation of the web assets. The HTML pages are compiled into
+    // the binary via `include_str!` and the wasm-bindgen output (canvas.js,
+    // canvas_bg.wasm, solitaire_wasm.*) keeps fixed filenames that change in
+    // place on every deploy. Without this, browsers heuristically cache them
+    // and keep serving stale builds even after a hard reload. `no-cache` lets
+    // the browser keep a copy but revalidate first; ServeDir supplies
+    // Last-Modified/ETag so unchanged assets still return a cheap 304.
+    headers.insert("Cache-Control", HeaderValue::from_static("no-cache"));
     res
 }