diff --git a/apps/edr-passenger-web/backoffice/src/middleware.ts b/apps/edr-passenger-web/backoffice/src/middleware.ts
index d665aee3f..db7af8568 100644
--- a/apps/edr-passenger-web/backoffice/src/middleware.ts
+++ b/apps/edr-passenger-web/backoffice/src/middleware.ts
@@ -85,6 +85,9 @@ export function middleware(request: NextRequest) {
   }
 
   response.headers.set('Content-Security-Policy', csp);
+  // Anti-clickjacking. `frame-ancestors 'none'` (in the CSP above) is the modern control;
+  // X-Frame-Options: DENY is the legacy equivalent for older browsers and scanners.
+  response.headers.set('X-Frame-Options', 'DENY');
   return response;
 }
 
diff --git a/apps/edr-passenger-web/portal/src/middleware.ts b/apps/edr-passenger-web/portal/src/middleware.ts
index fb1c27e84..c7960a601 100644
--- a/apps/edr-passenger-web/portal/src/middleware.ts
+++ b/apps/edr-passenger-web/portal/src/middleware.ts
@@ -108,6 +108,9 @@ export function middleware(request: NextRequest) {
   }
 
   response.headers.set('Content-Security-Policy', csp);
+  // Anti-clickjacking. `frame-ancestors 'none'` (in the CSP above) is the modern control;
+  // X-Frame-Options: DENY is the legacy equivalent for older browsers and scanners.
+  response.headers.set('X-Frame-Options', 'DENY');
   return response;
 }