diff --git a/lib/towerops_web/plugs/security_headers.ex b/lib/towerops_web/plugs/security_headers.ex
index d8aa4c9b..0c26d1f1 100644
--- a/lib/towerops_web/plugs/security_headers.ex
+++ b/lib/towerops_web/plugs/security_headers.ex
@@ -7,6 +7,7 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do
   - X-Frame-Options: Prevents clickjacking attacks
   - X-Content-Type-Options: Prevents MIME type sniffing
   - Referrer-Policy: Controls referrer information leakage
+  - Permissions-Policy: Disables browsing-topics API
 
   These headers are only applied in production to avoid interfering with
   development tools like LiveReload.
@@ -17,6 +18,12 @@ defmodule ToweropsWeb.Plugs.SecurityHeaders do
   def init(opts), do: opts
 
   def call(conn, _opts) do
+    conn
+    |> put_resp_header("permissions-policy", "browsing-topics=()")
+    |> maybe_add_prod_headers()
+  end
+
+  defp maybe_add_prod_headers(conn) do
     if Application.get_env(:towerops, :env) == :prod do
       conn
       |> put_resp_header("content-security-policy", csp_header())