diff --git a/sws.toml b/sws.toml
index da50e69..61798ec 100644
--- a/sws.toml
+++ b/sws.toml
@@ -17,15 +17,16 @@ log-level = "info"
 
 #### Performance / caching
 
-# On-the-fly gzip, brotli and zstd compression (replaces nginx `gzip on`)
-compression = true
-
-# Serve pre-compressed .gz/.br/.zst files from disk when present
-compression-static = true
+# Compression is handled by the upstream reverse proxy, so it is disabled
+# here to avoid doing the work twice (wasted CPU per request). Re-enable if
+# SWS is ever exposed directly without a compressing proxy in front.
+compression = false
+compression-static = false
 
 # Emit Cache-Control + ETag headers with sensible per-content-type defaults.
-# SWS applies long-lived caching to static assets (images, css, js, fonts)
-# and short/no-cache to HTML, replacing the manual nginx `expires 1y` blocks.
+# The origin is the correct place to declare cacheability; the proxy/CDN
+# passes these through. SWS applies long-lived caching to static assets
+# (images, css, js, fonts) and short/no-cache to HTML.
 cache-control-headers = true
 
 #### Routing
@@ -36,8 +37,10 @@ page-fallback = "/public/index.html"
 
 #### Security
 
-# Opinionated security headers (safe defaults for a static site)
-security-headers = true
+# Security headers are set by the upstream reverse proxy, so they are
+# disabled here to avoid duplicate/conflicting headers. Let one layer own
+# the security posture. Re-enable if SWS is exposed without such a proxy.
+security-headers = false
 
 # Health endpoint at /health for container/K8s liveness probes
 health = true