diff --git a/roles/docker/templates/Caddyfile.j2 b/roles/docker/templates/Caddyfile.j2
index 85a82af..082e0be 100644
--- a/roles/docker/templates/Caddyfile.j2
+++ b/roles/docker/templates/Caddyfile.j2
@@ -1,7 +1,11 @@
 # Tell browsers to always use HTTPS for each site for a year. No
 # includeSubDomains, so hosts not served here are unaffected.
+# defer: replace any HSTS header an app sends itself, so there's only one.
 (hsts) {
-    header Strict-Transport-Security "max-age=31536000"
+    header {
+        Strict-Transport-Security "max-age=31536000"
+        defer
+    }
 }
 
 {{ subdomains.pocketid }} {