diff --git a/.Nova/devops.md b/.Nova/devops.md
index 2bc482b4..902dba21 100644
--- a/.Nova/devops.md
+++ b/.Nova/devops.md
@@ -6,3 +6,13 @@
 - **Signal**: Performance logs (redundant GitHub API calls) and Security best practices (missing HSTS/X-Frame-Options).
 - **Metric**: Zero security regressions, reduced GitHub API dependency for repeat visitors.
 - **Abort Triggers**: None encountered.
+
+## 2026-06-09 - Global Infrastructure Hardening & Asset Optimization
+
+- **Optimization**: Global Security Headers & Immutable Asset Caching.
+- **Signal**: Security best practices (Defense in Depth) and Performance metrics (LCP/Bandwidth optimization).
+- **Implementation**:
+  - Hardened `src/pages/api/chat.ts` with `Referrer-Policy` and `Permissions-Policy`.
+  - Established `public/_headers` for Cloudflare Pages to enforce site-wide security and aggressive caching for `/_astro/*` assets.
+- **Metric**: Zero security regressions, optimized cache hit potential for fingerprinted assets.
+- **Abort Triggers**: None encountered.
diff --git a/public/_headers b/public/_headers
new file mode 100644
index 00000000..61f9ae10
--- /dev/null
+++ b/public/_headers
@@ -0,0 +1,9 @@
+/*
+  X-Content-Type-Options: nosniff
+  X-Frame-Options: DENY
+  Strict-Transport-Security: max-age=31536000; includeSubDomains
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: accelerometer=(), camera=(), geolocation=(), microphone=()
+
+/_astro/*
+  Cache-Control: public, max-age=31536000, immutable
diff --git a/src/pages/api/chat.ts b/src/pages/api/chat.ts
index 2c4cff21..a9a5a0bf 100644
--- a/src/pages/api/chat.ts
+++ b/src/pages/api/chat.ts
@@ -7,6 +7,8 @@ const jsonHeaders = {
   'X-Frame-Options': 'DENY',
   'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
   'Content-Security-Policy': "default-src 'none'; frame-ancestors 'none';",
+  'Referrer-Policy': 'strict-origin-when-cross-origin',
+  'Permissions-Policy': 'accelerometer=(), camera=(), geolocation=(), microphone=()',
 } as const;
 
 export const prerender = false;
@@ -106,6 +108,8 @@ Keep your responses brief, typically 2-3 sentences.`;
         'X-Frame-Options': 'DENY',
         'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
         'Content-Security-Policy': "default-src 'none'; frame-ancestors 'none';",
+        'Referrer-Policy': 'strict-origin-when-cross-origin',
+        'Permissions-Policy': 'accelerometer=(), camera=(), geolocation=(), microphone=()',
       },
     });
   } catch (error: unknown) {