diff --git a/_headers b/_headers
index 0d75eed..8ae9a5b 100644
--- a/_headers
+++ b/_headers
@@ -20,3 +20,25 @@
   Referrer-Policy: strict-origin-when-cross-origin
   Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; worker-src 'self' blob:; connect-src 'self' https://cloudflareinsights.com; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'
+
+# The files index.html and the document pages request with a ?v= query.
+# Their cache is busted by the number, which CI makes sure moves whenever
+# the file does, so the copy a browser holds can be trusted for as long as
+# a browser will keep it. Without this every asset carried Cloudflare's
+# default of max-age=0, and a returning visitor revalidated the stylesheet
+# and the generator on every load. Pages stay on the default: their names
+# never change, so they have to be checked each time. The vendored GIF
+# encoder is left out too; it carries no ?v=, so a swapped file under the
+# same name would sit stale for a year.
+/style.css
+  Cache-Control: public, max-age=31536000, immutable
+/generator.js
+  Cache-Control: public, max-age=31536000, immutable
+/guide.css
+  Cache-Control: public, max-age=31536000, immutable
+/screenshot.png
+  Cache-Control: public, max-age=31536000, immutable
+/screenshot.webp
+  Cache-Control: public, max-age=31536000, immutable
+/screenshot-800.webp
+  Cache-Control: public, max-age=31536000, immutable