diff --git a/server/server.js b/server/server.js
index 89c4782..6aec75a 100644
--- a/server/server.js
+++ b/server/server.js
@@ -19,6 +19,21 @@ const MODE = process.env.EXHIBIT_MODE || 'dev';
 const app = express();
 app.use(express.json({ limit: '20mb' }));   // base64 asset uploads
 
+/* ---------- cache policy ----------
+ * ES modules are fetched under their own URLs, so a cache-busting query on the
+ * entry point does nothing for its imports — a stale detect.js or solve-cv.js
+ * silently keeps running after a deploy. App code and HTML therefore revalidate
+ * every load (ETag makes that a cheap 304), while the 13MB OpenCV.js WASM is
+ * cached hard: it only changes when its pinned version does. */
+app.use((req, res, next) => {
+  if (req.path === '/vendor/opencv.js') {
+    res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+  } else if (/\.(js|html)$/.test(req.path) || req.path === '/') {
+    res.setHeader('Cache-Control', 'no-cache');
+  }
+  next();
+});
+
 // ---------- public static ----------
 app.use(express.static(path.join(__dirname, '..', 'public')));
 app.use('/data/ghosts.json', express.static(path.join(__dirname, '..', 'data', 'ghosts.json')));