diff --git a/src/index.ts b/src/index.ts
index ddf0e91..de27bce 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -105,29 +105,13 @@ import {
 	console.log(`[Startup] Environment validated (${nodeEnv} mode)`);
 })();
 
-import { SECURITY_HEADERS } from "./lib/security-headers";
-
-// Wrap HTML imports to add security headers. Bun's HTML imports are
-// Response objects with ReadableStream bodies that can only be consumed
-// once. We clone the response before adding headers so the original
-// stream remains available for subsequent requests.
-function withHeaders(html: unknown): () => Response {
-	return () => {
-		const res = html as Response;
-		const cloned = res.clone();
-		for (const [key, value] of Object.entries(SECURITY_HEADERS)) {
-			cloned.headers.set(key, value);
-		}
-		return cloned;
-	};
-}
 
 const server = Bun.serve({
 	port: env.PORT ? Number.parseInt(env.PORT, 10) : 3000,
 	routes: {
 		"/favicon.svg": Bun.file("./public/favicon.svg"),
 		"/logo.svg": Bun.file("./public/logo.svg"),
-		"/": withHeaders(indexHTML),
+		"/": indexHTML,
 		"/health": () => {
 			try {
 				// Verify database is accessible
@@ -143,11 +127,11 @@ const server = Bun.serve({
 				);
 			}
 		},
-		"/admin": withHeaders(adminHTML),
-		"/admin/invites": withHeaders(adminInvitesHTML),
+		"/admin": adminHTML,
+		"/admin/invites": adminInvitesHTML,
 		"/admin/apps": () => Response.redirect("/admin/clients", 302),
-		"/admin/clients": withHeaders(adminClientsHTML),
-		"/login": withHeaders(loginHTML),
+		"/admin/clients": adminClientsHTML,
+		"/login": loginHTML,
 		"/docs": docsPage,
 		"/docs.md": docsMarkdown,
 		"/docs.css": Bun.file("./public/docs.css"),
@@ -155,7 +139,7 @@ const server = Bun.serve({
 		"/styles.css": Bun.file("./src/styles.css"),
 		"/ds/tokens.css": Bun.file("./src/client/ds/tokens.css"),
 		"/ds/components.css": Bun.file("./src/client/ds/components.css"),
-		"/apps": withHeaders(appsHTML),
+		"/apps": appsHTML,
 		// Well-known endpoints
 		"/.well-known/security.txt": () => {
 			const expiryDate = new Date();