diff --git a/config/settings/selfhosted.py b/config/settings/selfhosted.py
index b98b551..a181f5b 100644
--- a/config/settings/selfhosted.py
+++ b/config/settings/selfhosted.py
@@ -131,13 +131,11 @@ CSRF_COOKIE_HTTPONLY = True   # Prevent JavaScript access to CSRF cookie
 SESSION_COOKIE_HTTPONLY = True  # Prevent JavaScript access to session cookie
 
 # Additional Security Headers
-SECURE_BROWSER_XSS_FILTER = True
-SECURE_CONTENT_TYPE_NOSNIFF = True
+# Note: All security headers are now configured in Nginx Proxy Manager
+# This includes: CSP, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy
+# X-Frame-Options still set here for defense-in-depth
 X_FRAME_OPTIONS = 'DENY'  # Prevent clickjacking
 
-# Note: Content Security Policy (CSP) is configured in Nginx Proxy Manager
-# See NPM Advanced config for CSP header configuration
-
 # Static files
 STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'