diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix
index ae17b0a..11dba6e 100644
--- a/hosts/vm/nextcloud/nextcloud.nix
+++ b/hosts/vm/nextcloud/nextcloud.nix
@@ -54,11 +54,24 @@
   };
 
   # Activation CORS pour récuppérer les agendas depuis le wiki
+  # On est obligé de répéter les headers communs de sécurité car ils ne sont pas au même niveau
+  # https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
   services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig =
+    let
+      base_headers = ''
+        add_header X-Content-Type-Options nosniff;
+        add_header X-Robots-Tag noindex, nofollow;
+        add_header X-Permitted-Cross-Domain-Policies none;
+        add_header X-Frame-Options sameorigin;
+        add_header Referrer-Policy no-referrer;
+        add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always;
+        add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      '';
+    in
     ''
-      add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always;
-      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      ${base_headers}
       if ($request_method = 'OPTIONS') {
+        ${base_headers}
         add_header 'Access-Control-Max-Age' 86400;
         add_header 'Content-Type' 'text/plain; charset=utf-8';
         add_header 'Content-Length' 0;