diff --git a/mcpjam-inspector/server/app.ts b/mcpjam-inspector/server/app.ts
index 8eb7029df..e7698a337 100644
--- a/mcpjam-inspector/server/app.ts
+++ b/mcpjam-inspector/server/app.ts
@@ -186,10 +186,10 @@ export function createHonoApp() {
     return c.json({ status: "ok", timestamp: new Date().toISOString() });
   });
 
-  // Guest JWT JWKS endpoint — public, cacheable, no auth required.
+  // Guest JWT JWKS endpoint — public, no auth required, avoid edge caching.
   // Convex uses this to verify guest JWTs natively.
   app.get("/guest/jwks", (c) => {
-    c.header("Cache-Control", "public, max-age=3600");
+    c.header("Cache-Control", "no-store");
     return c.json(getGuestJwks());
   });
 
diff --git a/mcpjam-inspector/server/routes/web/__tests__/guest-jwks.test.ts b/mcpjam-inspector/server/routes/web/__tests__/guest-jwks.test.ts
index 7388e2f57..15e3ed1c1 100644
--- a/mcpjam-inspector/server/routes/web/__tests__/guest-jwks.test.ts
+++ b/mcpjam-inspector/server/routes/web/__tests__/guest-jwks.test.ts
@@ -42,11 +42,11 @@ describe("GET /api/web/guest-jwks", () => {
     rmSync(testGuestKeyDir, { recursive: true, force: true });
   });
 
-  it("returns a public, cacheable JWKS document", async () => {
+  it("returns a non-cacheable JWKS document", async () => {
     const response = await app.request("/api/web/guest-jwks");
 
     expect(response.status).toBe(200);
-    expect(response.headers.get("cache-control")).toBe("public, max-age=3600");
+    expect(response.headers.get("cache-control")).toBe("no-store");
     expect(response.headers.get("content-type")).toContain("application/json");
 
     const body = await response.json();
diff --git a/mcpjam-inspector/server/routes/web/index.ts b/mcpjam-inspector/server/routes/web/index.ts
index 29bd4c6df..7a64ae841 100644
--- a/mcpjam-inspector/server/routes/web/index.ts
+++ b/mcpjam-inspector/server/routes/web/index.ts
@@ -39,7 +39,7 @@ web.route("/guest-session", guestSession);
 
 // Public JWKS endpoint for guest JWT verification.
 web.get("/guest-jwks", (c) => {
-  c.header("Cache-Control", "public, max-age=3600");
+  c.header("Cache-Control", "no-store");
   return c.json(getGuestJwks());
 });