diff --git a/knotmirror/xrpc/xrpc.go b/knotmirror/xrpc/xrpc.go
index ee304876f..ac88c1d1c 100644
--- a/knotmirror/xrpc/xrpc.go
+++ b/knotmirror/xrpc/xrpc.go
@@ -206,7 +206,8 @@ func setCacheControl(w http.ResponseWriter, refs ...string) {
 	if len(refs) > 0 && lo.EveryBy(refs, func(ref string) bool { return gitutil.Rev(ref).IsObjectID() }) {
 		w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
 	} else {
-		w.Header().Set("Cache-Control", "public, no-cache")
+		// ref names are mutable, no-cache here lets edge caches cache the response
+		w.Header().Set("Cache-Control", "private, no-store")
 	}
 }