diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
index de5b53639..0db4d1ccd 100644
--- a/apps/server/src/app.ts
+++ b/apps/server/src/app.ts
@@ -74,6 +74,16 @@ async function buildApp(deps: AppDeps) {
   const logger = useLogger('app').useGlobalConfig()
 
   const app = new Hono<HonoEnv>()
+    .use('*', async (c, next) => {
+      await next()
+
+      // NOTICE: All API responses should be non-cacheable. Auth responses can
+      // carry session state through redirects, and stale API payloads are not
+      // safe to serve from edge caches after user/account mutations.
+      c.res.headers.set('Cache-Control', 'no-store, no-cache, private, max-age=0')
+      c.res.headers.set('Pragma', 'no-cache')
+      c.res.headers.set('Expires', '0')
+    })
     .use(
       '/api/*',
       cors({
diff --git a/apps/server/src/libs/auth.ts b/apps/server/src/libs/auth.ts
index 31cfcd480..4265f2b62 100644
--- a/apps/server/src/libs/auth.ts
+++ b/apps/server/src/libs/auth.ts
@@ -31,6 +31,15 @@ export function createAuth(db: Database, env: Env, metrics?: AuthMetrics | null)
       enabled: true,
     },
 
+    session: {
+      // NOTICE: keep a short-lived signed session cache cookie so follow-up
+      // session reads avoid hitting the database on every request.
+      cookieCache: {
+        enabled: true,
+        maxAge: 60 * 5,
+      },
+    },
+
     baseURL: env.API_SERVER_URL,
     trustedOrigins: request => getAuthTrustedOrigins(env, request),