diff --git a/files/galaxy/config/security.txt b/files/galaxy/config/security.txt
new file mode 100644
index 000000000..7380cc867
--- /dev/null
+++ b/files/galaxy/config/security.txt
@@ -0,0 +1,4 @@
+Contact: mailto:galaxy@informatik.uni-freiburg.de
+Expires: 2030-06-19T13:03:00.000Z
+Preferred-Languages: en
+Canonical: https://usegalaxy.eu/.well-known/security.txt
diff --git a/sn09.yml b/sn09.yml
index 9c7ef6ae5..e612d9d6d 100644
--- a/sn09.yml
+++ b/sn09.yml
@@ -135,6 +135,15 @@
       ansible.builtin.copy:
         content: '{{ firewall_htcondor_shared_port_service }}'
         dest: /etc/firewalld/services/htcondor-shared-port.xml
+
+    - name: Deploy security.txt
+      ansible.builtin.copy:
+        src: files/galaxy/security.txt
+        dest: /etc/nginx/security.txt
+        owner: root
+        group: root
+        mode: '0644'
+
   post_tasks:
     - name: Write Galaxy __galaxy_client_build_version and __galaxy_current_commit_id
       delegate_to: 127.0.0.1
diff --git a/templates/nginx/galaxy-main.j2 b/templates/nginx/galaxy-main.j2
index 0fae9881e..cf331a423 100644
--- a/templates/nginx/galaxy-main.j2
+++ b/templates/nginx/galaxy-main.j2
@@ -254,6 +254,12 @@ server {
             proxy_pass          http://127.0.0.1:{{ gie_proxy_port }};
         }
 
+    location = /.well-known/security.txt {
+        alias /etc/nginx/security.txt;
+        default_type text/plain;
+        add_header Cache-Control "no-store";
+    }
+
     location /.well-known/ {
         proxy_pass          http://127.0.0.1:8118;
         proxy_set_header    Host                $host;