diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 6f2696ee..2b97e4ca 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -418,11 +418,7 @@ in
         '';
       }
       {
-        assertion =
-          !cfg.hsts.enable
-          || cfg.selfSignedTls
-          || cfg.tls.certDir != null
-          || cfg.tls.acme.enable;
+        assertion = !cfg.hsts.enable || cfg.selfSignedTls || cfg.tls.certDir != null || cfg.tls.acme.enable;
         message = ''
           services.hyperhive.gateway.hsts.enable = true requires TLS to be
           configured (selfSignedTls, tls.certDir, or tls.acme.enable). HSTS
@@ -549,10 +545,12 @@ in
 
           # Security headers added at the server scope on every vhost.
           # nginx's add_header inheritance rule: a location that defines its
-          # own add_header does NOT inherit the server-level ones, so API
-          # locations with CORS headers (e.g. /.well-known/matrix/client,
-          # /_matrix/) are unaffected. HTML-serving and proxy locations that
-          # carry no add_header of their own pick these up automatically.
+          # own add_header does NOT inherit the server-level ones. Any
+          # location with its own add_header (e.g. CORS on /.well-known or
+          # /_matrix/) must repeat the security headers explicitly — see those
+          # locations below. HTML-serving and proxy locations that carry no
+          # add_header of their own pick these up from the server scope
+          # automatically.
           hstsDirectives = lib.concatStringsSep "; " (
             [ "max-age=${toString cfg.hsts.maxAge}" ]
             ++ lib.optional cfg.hsts.includeSubDomains "includeSubDomains"
@@ -726,6 +724,7 @@ in
                         "= /.well-known/matrix/client" = {
                           extraConfig = ''
                             default_type application/json;
+                            ${securityHeaders}
                             add_header Access-Control-Allow-Origin *;
                             return 200 '{"m.homeserver":{"base_url":"${clientBaseUrl}"}}';
                           '';
@@ -906,6 +905,7 @@ in
                         client_max_body_size 50M;
                         proxy_read_timeout 1h;
                         proxy_send_timeout 1h;
+                        ${securityHeaders}
                         add_header Access-Control-Allow-Origin *;
                       '';
                     };