diff --git a/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf b/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf
index 45dbc28..9b6fd3d 100644
--- a/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf
+++ b/simplerisk-minimal/common/etc/apache2/sites-enabled/default-ssl.conf
@@ -41,9 +41,10 @@ SSLStrictSNIVHostCheck Off
         # combined format above does not carry.
         CustomLog /var/log/apache2/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
 
-        Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
-        Header always set X-Xss-Protection "1; mode=block"
-        Header always set Referrer-Policy "no-referrer-when-downgrade"
+        # SR-2589: the app (add_security_headers() in includes/functions.php) owns Referrer-Policy and sends
+        # `origin`. A header set here with `always` is emitted in addition to the app's, giving two
+        # conflicting values. setifempty only fills it in for responses the app did not set (static files).
+        Header setifempty Referrer-Policy "origin"
         Header always unset X-Powered-By
         Header unset X-Powered-By
         Header always unset X-Generator
diff --git a/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf b/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf
index 0ce86b9..1ac9d19 100644
--- a/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf
+++ b/simplerisk/common/etc/apache2/sites-enabled/default-ssl.conf
@@ -17,9 +17,10 @@ SSLStrictSNIVHostCheck Off
         SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
         CustomLog /var/log/apache2/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
 
-        Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
-        Header always set X-Xss-Protection "1; mode=block"
-        Header always set Referrer-Policy "no-referrer-when-downgrade"
+        # SR-2589: the app (add_security_headers() in includes/functions.php) owns Referrer-Policy and sends
+        # `origin`. A header set here with `always` is emitted in addition to the app's, giving two
+        # conflicting values. setifempty only fills it in for responses the app did not set (static files).
+        Header setifempty Referrer-Policy "origin"
         Header always unset X-Powered-By
         Header unset X-Powered-By
         Header always unset X-Generator