diff --git a/bingo_web.rb b/bingo_web.rb
index fea9a14..cf72a86 100644
--- a/bingo_web.rb
+++ b/bingo_web.rb
@@ -12,6 +12,8 @@ class BingoWeb < Sinatra::Base
     # the card needs none of it.
     set :static, false
     set :show_exceptions, $env == 'development'
+    # HSTS (1 year, this host only); http:// already 308s at the edge.
+    set :protection, use: %i[strict_transport]
     set :host_authorization,
         { permitted_hosts: $env == 'production' ? HOSTS : [] }
   end
diff --git a/test/bingo_test.rb b/test/bingo_test.rb
index 22a97e8..808d8af 100644
--- a/test/bingo_test.rb
+++ b/test/bingo_test.rb
@@ -216,6 +216,12 @@ class BingoTest < Minitest::Test
     assert_includes last_response.body, '<link rel="icon" href="/favicon.svg" type="image/svg+xml">'
   end
 
+  def test_hsts
+    get '/en'
+    assert_equal 'max-age=31536000', last_response.headers['strict-transport-security']
+    assert_equal 'nosniff', last_response.headers['x-content-type-options']
+  end
+
   def test_root_varies_on_language
     get '/'
     assert_equal 'Accept-Language', last_response.headers['Vary']