diff --git a/src/gateway/public-gateway.mjs b/src/gateway/public-gateway.mjs
index a78ab84..c497dea 100644
--- a/src/gateway/public-gateway.mjs
+++ b/src/gateway/public-gateway.mjs
@@ -418,6 +418,9 @@ async function serve(res, name, reqPath, baseHref) {
   // Public content: let pages on other origins (sirius.x, theseus.x) read a
   // name's files with fetch(), e.g. Sirius Studio inlining a stylesheet.
   res.setHeader("access-control-allow-origin", "*");
+  // Short lifetime: without it browsers apply heuristic caching to files from
+  // Sia (no ETag) and keep old scripts for hours after a publish.
+  res.setHeader("cache-control", "public, max-age=120");
   let entry;
   try { entry = await resolve(name); } catch (e) { res.writeHead(502); return res.end("resolve error: " + e.message); }
   if (!entry) { res.writeHead(404, { "content-type": "text/html" }); return res.end(nx(name)); }