diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix
index aabeac25..c2c99f8e 100644
--- a/nix/module-eval/core-toggle.nix
+++ b/nix/module-eval/core-toggle.nix
@@ -499,18 +499,22 @@ let
       # with an error that says nothing about the session; only a request that
       # asks for `text/html` gets the login. The `/` clause is the control: the
       # page route still redirects, so a pass means the two routes differ.
+      # Each answer carries the gateway's security headers, which a location
+      # (or `if`) with an `add_header` of its own would otherwise drop.
       name = "the controller API answers a refused bearer caller or fetch 401 and a page request the login";
       ok =
         let
           l = allLocal.services.nginx.virtualHosts."t.local".locations;
           api = l."/api/".extraConfig;
           refused = l."@swarm_api_unauthorized".extraConfig;
+          sec = allLocal.services.hyperhive.gateway.lib.securityHeaders;
         in
         lib.hasInfix "error_page 401 = @swarm_api_unauthorized;" api
         && !(lib.hasInfix "=302" api)
         && lib.hasInfix ''proxy_set_header Authorization "";'' api
-        && lib.hasInfix "if ($http_authorization) {\n  add_header WWW-Authenticate 'Bearer realm=\"swarm\"' always;\n  return 401;\n}" refused
+        && lib.hasInfix "if ($http_authorization) {\n  ${sec}\n  add_header WWW-Authenticate 'Bearer realm=\"swarm\"' always;\n  return 401;\n}" refused
         && lib.hasInfix "if ($http_accept ~* \"text/html\") {\n  return 302 https://auth.t.local/?rd=$target_url;\n}" refused
+        && lib.hasPrefix sec refused
         && lib.hasInfix "}\nadd_header WWW-Authenticate 'Bearer realm=\"swarm\"' always;\nreturn 401;" refused
         && lib.hasInfix "error_page 401 =302 https://auth.t.local/" l."/".extraConfig;
     }