diff --git a/next.config.ts b/next.config.ts
index 1ad2006d3..2f931b035 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -27,6 +27,21 @@ const nextConfig: NextConfig = {
   // bfcache restore path stays clear. The other CSP-style security
   // headers already live on the response via the standalone runtime;
   // we add only the bfcache hint here.
+  //
+  // v1.4.34 IW-A — second rule layers the bfcache-friendly
+  // `Cache-Control` directive onto every authenticated HTML page
+  // response (the source negative-lookahead excludes `/api/*` and
+  // `/_next/*` so static assets keep their immutable caching and API
+  // routes keep their explicit headers). The framework default for
+  // pages that read cookies is `no-store, must-revalidate`, which
+  // Chromium counts as a hard bfcache breaker. `private, max-age=0,
+  // must-revalidate` keeps shared caches out (proxies, CDNs cannot
+  // store personal data), still forces revalidation on every
+  // navigation so session swaps detect on the wire, and is
+  // bfcache-eligible — back/forward navigation restores the page
+  // from memory instead of paying a full reload. See
+  // `src/lib/http/cache-headers.ts` for the typed constant reused by
+  // route handlers that opt into the same posture.
   async headers() {
     return [
       {
@@ -35,6 +50,15 @@ const nextConfig: NextConfig = {
           { key: "Permissions-Policy", value: "unload=()" },
         ],
       },
+      {
+        source: "/((?!api|_next).*)",
+        headers: [
+          {
+            key: "Cache-Control",
+            value: "private, max-age=0, must-revalidate",
+          },
+        ],
+      },
     ];
   },
   serverExternalPackages: [
@@ -53,6 +77,16 @@ const nextConfig: NextConfig = {
   outputFileTracingIncludes: {
     "*": ["./src/lib/ai/prompts/safety-contracts.*.yaml"],
   },
+  // v1.4.34 IW-A — silence the Turbopack NFT trace warnings emitted
+  // during `next build`. The tracer follows the `MAXMIND_LICENSE_KEY`
+  // env access in `src/lib/geo.ts` back into the config file, then
+  // emits "cannot be traced" warnings for paths it tried to walk
+  // (next.config.ts → mood-entries/bulk route, etc.). The standalone
+  // bundle is controlled by `output: "standalone"` above; this exclude
+  // only narrows trace reporting and has no runtime effect.
+  outputFileTracingExcludes: {
+    "*": ["./next.config.ts"],
+  },
   experimental: {
     optimizePackageImports: ["recharts", "lucide-react"],
   },