diff --git a/packages/wallet/frontend/next.config.js b/packages/wallet/frontend/next.config.js
index 6fdd5b811..f6d1a363d 100644
--- a/packages/wallet/frontend/next.config.js
+++ b/packages/wallet/frontend/next.config.js
@@ -41,6 +41,10 @@ const nextConfig = {
           {
             key: 'Content-Security-Policy',
             value: "frame-ancestors 'none';"
+          },
+          {
+            key: 'Strict-Transport-Security',
+            value: 'max-age=31536000; includeSubDomains'
           }
         ]
       }
diff --git a/packages/wallet/frontend/src/middleware.ts b/packages/wallet/frontend/src/middleware.ts
index d3e5c618e..5a6e438b1 100644
--- a/packages/wallet/frontend/src/middleware.ts
+++ b/packages/wallet/frontend/src/middleware.ts
@@ -15,6 +15,10 @@ const publicPaths = ['/auth*']
 function withFrameProtection(response: NextResponse): NextResponse {
   response.headers.set('X-Frame-Options', 'DENY')
   response.headers.set('Content-Security-Policy', "frame-ancestors 'none';")
+  response.headers.set(
+    'Strict-Transport-Security',
+    'max-age=31536000; includeSubDomains'
+  )
   return response
 }