diff --git a/next.config.ts b/next.config.ts
index 101d19d..33bf79d 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -42,7 +42,19 @@ const nextConfig: NextConfig = {
             key: 'X-Content-Type-Options',
             value: 'nosniff',
           },
-          // Security headers moved to middleware (CSP, HSTS, Referrer-Policy, Permissions-Policy)
+          {
+            key: 'Strict-Transport-Security',
+            value: 'max-age=31536000; includeSubDomains; preload',
+          },
+          {
+            key: 'Referrer-Policy',
+            value: 'strict-origin-when-cross-origin',
+          },
+          {
+            key: 'Permissions-Policy',
+            value: 'geolocation=(), microphone=(), camera=(), payment=(), usb=()',
+          },
+          // Content-Security-Policy is handled by @next-safe/middleware in src/middleware.ts
         ],
       },
       {
diff --git a/package.json b/package.json
index 6f3ec94..f5a6b7a 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,7 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
+    "@next-safe/middleware": "^0.10.0",
     "openai": "^4.77.0",
     "@mdx-js/loader": "^3.1.0",
     "@mdx-js/mdx": "^3.1.0",