diff --git a/.github/workflows/lif_mdr_frontend.yml b/.github/workflows/lif_mdr_frontend.yml
index 7384217f..789a62f6 100644
--- a/.github/workflows/lif_mdr_frontend.yml
+++ b/.github/workflows/lif_mdr_frontend.yml
@@ -61,5 +61,9 @@ jobs:
       run: |
         aws s3 sync --delete dist s3://${{ env.ENV_NAME }}-mdr-${{ env.AWS_ACCOUNT_ID }}-${{ env.AWS_REGION }}
         id=$(aws ssm get-parameter --name "/${{ env.ENV_NAME }}/mdr/DistributionId" --query "Parameter.Value" --output text)
-        aws cloudfront create-invalidation --distribution-id $id --paths "/"
+        # Invalidate "/*", not "/". `s3 sync --delete` replaces the whole
+        # object set, and stable-named files (index.html, robots.txt) keep
+        # serving from the edge cache otherwise. Hashed asset filenames
+        # cache-bust themselves; these do not.
+        aws cloudfront create-invalidation --distribution-id $id --paths "/*"
 
diff --git a/frontends/lif_advisor_app/public/robots.txt b/frontends/lif_advisor_app/public/robots.txt
new file mode 100644
index 00000000..1793d7ca
--- /dev/null
+++ b/frontends/lif_advisor_app/public/robots.txt
@@ -0,0 +1,14 @@
+# LIF — dev/demo environments are not intended for public indexing.
+#
+# Disallow everything. These hosts serve non-production evaluation
+# environments; there is no content here that should appear in search
+# results, and indexing them invites crawler traffic we don't want.
+#
+# Deliberately does NOT enumerate paths. Listing specific routes here
+# would advertise them to the scanners this is meant to discourage.
+#
+# NOTE: robots.txt is advisory. Well-behaved crawlers honor it; scanners
+# and malicious bots ignore it entirely. It is not a security control.
+
+User-agent: *
+Disallow: /
diff --git a/frontends/mdr-frontend/public/robots.txt b/frontends/mdr-frontend/public/robots.txt
new file mode 100644
index 00000000..1793d7ca
--- /dev/null
+++ b/frontends/mdr-frontend/public/robots.txt
@@ -0,0 +1,14 @@
+# LIF — dev/demo environments are not intended for public indexing.
+#
+# Disallow everything. These hosts serve non-production evaluation
+# environments; there is no content here that should appear in search
+# results, and indexing them invites crawler traffic we don't want.
+#
+# Deliberately does NOT enumerate paths. Listing specific routes here
+# would advertise them to the scanners this is meant to discourage.
+#
+# NOTE: robots.txt is advisory. Well-behaved crawlers honor it; scanners
+# and malicious bots ignore it entirely. It is not a security control.
+
+User-agent: *
+Disallow: /