diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml
index f8ed6269ff2..ed33f509928 100644
--- a/.github/workflows/docs-build.yml
+++ b/.github/workflows/docs-build.yml
@@ -50,6 +50,11 @@ jobs:
           mkdir -p docs/_static/vortex-spark
           cp -r java/vortex-jni/build/docs/javadoc/* docs/_static/vortex-jni/
           cp -r java/vortex-spark/build/vortex-spark_2.13/docs/javadoc/* docs/_static/vortex-spark/
+          # JDK 17's javadoc stylesheet imports a font file that JDK 17 never
+          # generates, so every page requested a missing file. The pages fall
+          # back to the system fonts named in the stylesheet either way.
+          sed -i "/@import url('resources\/fonts\/dejavu.css');/d" \
+            docs/_static/vortex-jni/stylesheet.css docs/_static/vortex-spark/stylesheet.css
       - name: Build Python and Rust docs
         run: uv run --all-packages make -C docs html
       - name: Upload HTML
diff --git a/docs/_theme/vortex/layout.html b/docs/_theme/vortex/layout.html
index 30be1fd64b6..8e0950f9c3b 100644
--- a/docs/_theme/vortex/layout.html
+++ b/docs/_theme/vortex/layout.html
@@ -66,7 +66,7 @@
   <nav class="sidebar" id="nav" aria-label="{{ _('Site navigation') }}">
     {{ vortex_globaltoc }}
   </nav>
-  <main id="main" class="content">
+  <main id="main" class="content" role="main">
     {%- block body %}{% endblock %}
     <footer class="footer">
       {%- if page_source_suffix %}
diff --git a/docs/vercel-output-config.json b/docs/vercel-output-config.json
index 18abec34348..c258ae56ed3 100644
--- a/docs/vercel-output-config.json
+++ b/docs/vercel-output-config.json
@@ -11,12 +11,38 @@
       },
       "continue": true
     },
+    {
+      "src": "^/(.*)$",
+      "missing": [
+        {
+          "type": "host",
+          "value": "docs.vortex.dev"
+        }
+      ],
+      "headers": {
+        "Content-Security-Policy": "default-src 'none'; script-src 'self' https://vercel.live; style-src 'self' 'unsafe-inline' https://vercel.live; style-src-attr 'unsafe-inline'; img-src 'self' data: https://vercel.live https://vercel.com blob:; connect-src 'self' https://vercel.live wss://ws-us3.pusher.com; font-src https://vercel.live https://assets.vercel.com; frame-src https://vercel.live; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
+      },
+      "continue": true
+    },
     {
       "src": "^/_static/vortex-(jni|spark)/(.*)$",
       "headers": {
         "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
       },
       "continue": true
+    },
+    {
+      "src": "^/_static/vortex-(jni|spark)/(.*)$",
+      "missing": [
+        {
+          "type": "host",
+          "value": "docs.vortex.dev"
+        }
+      ],
+      "headers": {
+        "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline' https://vercel.live; style-src 'self' 'unsafe-inline' https://vercel.live; img-src 'self' data: https://vercel.live https://vercel.com blob:; font-src 'self' https://vercel.live https://assets.vercel.com; connect-src 'self' https://vercel.live wss://ws-us3.pusher.com; frame-src 'self' https://vercel.live; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
+      },
+      "continue": true
     }
   ]
 }
diff --git a/vortex-web/vercel-output-config.json b/vortex-web/vercel-output-config.json
index db695c86361..76fc1d7b004 100644
--- a/vortex-web/vercel-output-config.json
+++ b/vortex-web/vercel-output-config.json
@@ -3,10 +3,40 @@
   "routes": [
     {
       "src": "/assets/(.*)",
-      "headers": { "Cache-Control": "public, max-age=31536000, immutable" },
+      "headers": {
+        "Cache-Control": "public, max-age=31536000, immutable"
+      },
       "continue": true
     },
-    { "handle": "filesystem" },
-    { "src": "/(.*)", "dest": "/index.html" }
+    {
+      "src": "^/(.*)$",
+      "headers": {
+        "Content-Security-Policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self' https:; worker-src 'self'; object-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+        "X-Content-Type-Options": "nosniff",
+        "Referrer-Policy": "strict-origin-when-cross-origin",
+        "Cross-Origin-Opener-Policy": "same-origin"
+      },
+      "continue": true
+    },
+    {
+      "src": "^/(.*)$",
+      "missing": [
+        {
+          "type": "host",
+          "value": "explore.vortex.dev"
+        }
+      ],
+      "headers": {
+        "Content-Security-Policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval' https://vercel.live; style-src 'self' https://fonts.googleapis.com 'unsafe-inline' https://vercel.live; font-src 'self' https://fonts.gstatic.com https://vercel.live https://assets.vercel.com; img-src 'self' data: blob: https://vercel.live https://vercel.com; connect-src 'self' https: https://vercel.live wss://ws-us3.pusher.com; worker-src 'self'; object-src 'none'; frame-src https://vercel.live; form-action 'self'; base-uri 'none'; frame-ancestors 'none'"
+      },
+      "continue": true
+    },
+    {
+      "handle": "filesystem"
+    },
+    {
+      "src": "/(.*)",
+      "dest": "/index.html"
+    }
   ]
 }