diff --git a/config/settings/selfhosted.py b/config/settings/selfhosted.py
index a181f5b..5728759 100644
--- a/config/settings/selfhosted.py
+++ b/config/settings/selfhosted.py
@@ -131,11 +131,14 @@ CSRF_COOKIE_HTTPONLY = True   # Prevent JavaScript access to CSRF cookie
 SESSION_COOKIE_HTTPONLY = True  # Prevent JavaScript access to session cookie
 
 # Additional Security Headers
-# Note: All security headers are now configured in Nginx Proxy Manager
-# This includes: CSP, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy
-# X-Frame-Options still set here for defense-in-depth
+# These are also set by NPM's "Block Common Exploits" feature for defense-in-depth
+SECURE_BROWSER_XSS_FILTER = True
+SECURE_CONTENT_TYPE_NOSNIFF = True
 X_FRAME_OPTIONS = 'DENY'  # Prevent clickjacking
 
+# Note: Content Security Policy (CSP) is configured in Nginx Proxy Manager
+# NPM also handles: HSTS, Referrer-Policy, Permissions-Policy
+
 # Static files
 STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'