diff --git a/caddy/WebCaddyfile.internal b/caddy/WebCaddyfile.internal
index 6fd904e6..e7b3c0d5 100644
--- a/caddy/WebCaddyfile.internal
+++ b/caddy/WebCaddyfile.internal
@@ -87,6 +87,14 @@
         file_server
     }
 
+    # --- Serve /.well-known (security.txt, RFC 9116) without SPA fallback ---
+    handle /.well-known/* {
+        root * /usr/share/caddy
+        encode zstd gzip
+        header Cache-Control "public, max-age=86400"
+        file_server
+    }
+
     # --- Optional: force SEO view for humans via ?__seo=1 ---
     @force_seo expression `{query}.matches("(^|&)(__seo=1)($|&)")`
     handle @force_seo {
diff --git a/caddy/WebCaddyfile.local b/caddy/WebCaddyfile.local
index 33d1460f..c0887949 100644
--- a/caddy/WebCaddyfile.local
+++ b/caddy/WebCaddyfile.local
@@ -73,6 +73,14 @@
 		file_server
 	}
 
+	# --- Serve /.well-known (security.txt, RFC 9116) without SPA fallback ---
+	handle /.well-known/* {
+		root * /usr/share/caddy
+		encode zstd gzip
+		header Cache-Control "public, max-age=86400"
+		file_server
+	}
+
 	# --- Serve SPA (simple) ---
 	handle @spa {
 		root * /usr/share/caddy
diff --git a/public/.well-known/security.txt b/public/.well-known/security.txt
new file mode 100644
index 00000000..53494e75
--- /dev/null
+++ b/public/.well-known/security.txt
@@ -0,0 +1,4 @@
+Contact: mailto:gustavoocanto@gmail.com
+Expires: 2027-06-05T00:00:00.000Z
+Preferred-Languages: en
+Canonical: https://oullin.io/.well-known/security.txt
diff --git a/public/robots.txt b/public/robots.txt
new file mode 100644
index 00000000..2a77a0ab
--- /dev/null
+++ b/public/robots.txt
@@ -0,0 +1,3 @@
+User-agent: *
+Allow: /
+Disallow: /seo
diff --git a/tests/caddy/web-caddyfile.test.ts b/tests/caddy/web-caddyfile.test.ts
index a8df43e2..8cd09feb 100644
--- a/tests/caddy/web-caddyfile.test.ts
+++ b/tests/caddy/web-caddyfile.test.ts
@@ -45,4 +45,8 @@ describe('production web Caddy relay contract', () => {
 
 		expect(relayExclusions.length).toBeGreaterThanOrEqual(2);
 	});
+
+	it('serves /.well-known (security.txt) as static files without SPA fallback', () => {
+		expect(caddyfile).toMatch(/handle \/\.well-known\/\*\s*{[^}]*root \* \/usr\/share\/caddy[^}]*file_server[^}]*}/s);
+	});
 });