diff --git a/internal/api/mobile_bundle.go b/internal/api/mobile_bundle.go
index fc09da0..73152eb 100644
--- a/internal/api/mobile_bundle.go
+++ b/internal/api/mobile_bundle.go
@@ -58,8 +58,15 @@ func (s *Server) handleMobileBundle(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Return YAML bundle with proper content-type
+	// Return YAML bundle with proper content-type. The bundle inlines a
+	// freshly-minted X25519 private key, so suppress every layer of cache
+	// between server and operator (intermediate proxies/CDNs, browser disk
+	// cache). Mirrors the Web-UI sibling at internal/web/handlers.go.
 	w.Header().Set("Content-Type", "application/yaml; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Expires", "0")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.WriteHeader(http.StatusOK)
 	if _, err := w.Write(bundle); err != nil {
 		s.logger.Error("write mobile bundle response", "error", err)
diff --git a/internal/api/mobile_bundle_test.go b/internal/api/mobile_bundle_test.go
index dcb8cd9..da08b01 100644
--- a/internal/api/mobile_bundle_test.go
+++ b/internal/api/mobile_bundle_test.go
@@ -52,6 +52,19 @@ func TestHandleMobileBundle_Success(t *testing.T) {
 		t.Errorf("Content-Type = %q, want 'application/yaml; charset=utf-8'", ct)
 	}
 
+	// Bundle inlines a private key — every cache between server and operator
+	// must drop the response. Mirrors the Web-UI sibling's headers.
+	for header, want := range map[string]string{
+		"Cache-Control":         "no-store",
+		"Pragma":                "no-cache",
+		"Expires":               "0",
+		"X-Content-Type-Options": "nosniff",
+	} {
+		if got := w.Header().Get(header); got != want {
+			t.Errorf("%s = %q, want %q", header, got, want)
+		}
+	}
+
 	// Verify body is valid YAML with expected keys
 	var yamlData map[string]interface{}
 	if err := yaml.Unmarshal(w.Body.Bytes(), &yamlData); err != nil {