diff --git a/contributors/emails/seraphine@Seraphines-Mac-Studio.local b/contributors/emails/seraphine@Seraphines-Mac-Studio.local
new file mode 100644
index 000000000000..55d62986543e
--- /dev/null
+++ b/contributors/emails/seraphine@Seraphines-Mac-Studio.local
@@ -0,0 +1,2 @@
+Bartok9
+# Seraphine Mac Studio local email on Bartok9 PR tips (per-PR attribution; Teknium/Daniel 2026-08-01)
diff --git a/gateway/platforms/api_server.py b/gateway/platforms/api_server.py
index 62dff2878fa5..c5143b1e2f65 100644
--- a/gateway/platforms/api_server.py
+++ b/gateway/platforms/api_server.py
@@ -809,6 +809,7 @@ def __len__(self) -> int:
 # ---------------------------------------------------------------------------
 
 _CORS_HEADERS = {
+    "Access-Control-Expose-Headers": "Location, X-Request-Id, Idempotency-Key",
     "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": "Authorization, Content-Type, Idempotency-Key",
 }
@@ -1025,6 +1026,7 @@ async def security_headers_middleware(request, handler):
         response = await handler(request)
         for k, v in _SECURITY_HEADERS.items():
             response.headers.setdefault(k, v)
+        response.headers.setdefault("Cache-Control", "no-store")
         return response
 else:
     security_headers_middleware = None  # type: ignore[assignment]