diff --git a/nix/host-modules/swarm-ui.nix b/nix/host-modules/swarm-ui.nix
index ee3cf1bf..a8ccfd43 100644
--- a/nix/host-modules/swarm-ui.nix
+++ b/nix/host-modules/swarm-ui.nix
@@ -323,8 +323,12 @@ in
         # 401 with a `WWW-Authenticate` header, which the UI reads as "log in
         # again" and answers with a reload. The header is also how the UI tells
         # this 401 from one the controller sends for its own reasons.
+        # The security headers are repeated inside the `if` block that sets its
+        # own `add_header`, which would otherwise drop them.
         "@swarm_api_unauthorized".extraConfig = ''
+          ${gatewayCfg.lib.securityHeaders}
           if ($http_authorization) {
+            ${gatewayCfg.lib.securityHeaders}
             add_header WWW-Authenticate 'Bearer realm="swarm"' always;
             return 401;
           }