diff --git a/docker/images/files/nginx-external-locations.conf b/docker/images/files/nginx-external-locations.conf
index c9c106864b..9cce57ca87 100644
--- a/docker/images/files/nginx-external-locations.conf
+++ b/docker/images/files/nginx-external-locations.conf
@@ -7,6 +7,7 @@ location ~ ^/github/penpot-files/(.+)$ {
     proxy_set_header User-Agent "curl/8.5.0";
     proxy_set_header Host "raw.githubusercontent.com";
     proxy_set_header Accept "*/*";
+    include /etc/nginx/nginx-security-headers.conf;
     add_header Access-Control-Allow-Origin $http_origin;
     proxy_buffering off;
 }
@@ -31,6 +32,7 @@ location ~ ^/internal/gfonts/font/(?<font_file>.+) {
 
     proxy_cache penpot;
 
+    include /etc/nginx/nginx-security-headers.conf;
     add_header Access-Control-Allow-Origin $http_origin;
     add_header Cache-Control max-age=86400;
     add_header X-Cache-Status $upstream_cache_status;
@@ -53,6 +55,7 @@ location ~ ^/internal/gfonts/css {
 
     proxy_cache penpot;
 
+    include /etc/nginx/nginx-security-headers.conf;
     add_header Access-Control-Allow-Origin $http_origin;
     add_header Cache-Control max-age=86400;
     add_header X-Cache-Status $upstream_cache_status;