diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 64a8d70..69e36a9 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -1558,7 +1558,7 @@ checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
 
 [[package]]
 name = "mangalord"
-version = "0.124.2"
+version = "0.124.3"
 dependencies = [
  "anyhow",
  "argon2",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index f1a00db..69a3500 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mangalord"
-version = "0.124.2"
+version = "0.124.3"
 edition = "2021"
 default-run = "mangalord"
 
diff --git a/backend/src/api/files.rs b/backend/src/api/files.rs
index 39befa4..e874e9b 100644
--- a/backend/src/api/files.rs
+++ b/backend/src/api/files.rs
@@ -49,6 +49,16 @@ async fn serve(State(state): State<AppState>, Path(key): Path<String>) -> AppRes
             HeaderName::from_static("x-content-type-options"),
             "nosniff".to_string(),
         ),
+        // Blobs are content-addressed by unguessable, immutable keys (a
+        // re-upload mints new UUIDs), so a fetched page/cover never changes.
+        // Cache it for a year and mark it `immutable` so browsers skip
+        // revalidation entirely — this is what lets the reader's page and
+        // next-chapter preloading hit cache instead of re-downloading (and
+        // re-proxying every byte through the SvelteKit node server in prod).
+        (
+            header::CACHE_CONTROL,
+            "public, max-age=31536000, immutable".to_string(),
+        ),
     ];
     Ok((headers, Body::from_stream(file.stream)).into_response())
 }
diff --git a/backend/tests/api_uploads.rs b/backend/tests/api_uploads.rs
index 77b8e3d..62b771e 100644
--- a/backend/tests/api_uploads.rs
+++ b/backend/tests/api_uploads.rs
@@ -172,6 +172,13 @@ async fn files_endpoint_streams_in_multiple_frames(pool: PgPool) {
         resp.headers().get("x-content-type-options").unwrap(),
         "nosniff"
     );
+    // Blobs are content-addressed by unguessable, immutable keys, so they're
+    // safe to cache forever — this is what makes the reader's page + next-
+    // chapter preloading actually hit cache instead of re-downloading.
+    assert_eq!(
+        resp.headers().get(header::CACHE_CONTROL).unwrap(),
+        "public, max-age=31536000, immutable"
+    );
 
     let mut body = resp.into_body();
     let mut frames = 0usize;
diff --git a/frontend/package.json b/frontend/package.json
index ee18e96..7f4a776 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mangalord-frontend",
-  "version": "0.124.2",
+  "version": "0.124.3",
   "private": true,
   "type": "module",
   "scripts": {