diff --git a/server.js b/server.js
index 86a78ec..99945b6 100644
--- a/server.js
+++ b/server.js
@@ -84,7 +84,19 @@ app.use('/api/auth/forgot-password', rateLimit({
 }));
 
 app.use(loggingMiddleware);
-app.use(express.static(path.join(__dirname, 'public')));
+app.use(express.static(path.join(__dirname, 'public'), {
+  setHeaders: (res, filePath) => {
+    if (filePath.endsWith('.html')) {
+      // Never cache HTML — ensures new deployments are picked up immediately
+      res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+      res.setHeader('Pragma', 'no-cache');
+      res.setHeader('Expires', '0');
+    } else if (filePath.match(/\.(js|css)$/)) {
+      // Short cache for JS/CSS — 1 hour
+      res.setHeader('Cache-Control', 'public, max-age=3600');
+    }
+  }
+}));
 
 // Routes
 app.use('/api/auth', require('./src/routes/auth'));
@@ -115,7 +127,12 @@ app.get('/api/health', (req, res) => {
   });
 });
 
-app.get('*', (req, res) => res.sendFile(path.join(__dirname, 'public', 'index.html')));
+app.get('*', (req, res) => {
+  res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+  res.setHeader('Pragma', 'no-cache');
+  res.setHeader('Expires', '0');
+  res.sendFile(path.join(__dirname, 'public', 'index.html'));
+});
 
 const PORT = process.env.PORT || 3000;
 server.listen(PORT, () => {