diff --git a/web-backend/server.js b/web-backend/server.js
index feed2af4..a6d545b3 100644
--- a/web-backend/server.js
+++ b/web-backend/server.js
@@ -364,7 +364,7 @@ app.use('/api/app/proxy', requireAuth, async (req, res) => {
         'Authorization': `Bearer ${req.session.tokens.access_token}`,
         'Content-Type': req.headers['content-type'] || 'application/json',
         'Accept': req.headers.accept || 'application/json',
-        'Document Policy': `js-profiling`
+        'Document Policy': 'js-profiling'
       },
       body: req.method !== 'GET' && req.method !== 'HEAD' ? JSON.stringify(req.body) : undefined
     })
diff --git a/web-frontend/nginx.conf b/web-frontend/nginx.conf
index e8ad8e3b..76f47187 100644
--- a/web-frontend/nginx.conf
+++ b/web-frontend/nginx.conf
@@ -7,6 +7,7 @@ server {
     # SPA fallback - return index.html for any unmatched routes
     location / {
         try_files $uri $uri/ /index.html;
+        add_header Document-Policy "js-profiling";
     }
 
     # Cache static assets