diff --git a/backend/package-lock.json b/backend/package-lock.json
index 57989716..0afba577 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -17,6 +17,7 @@
         "express": "^4.21.1",
         "express-rate-limit": "^8.4.0",
         "express-validator": "^7.2.0",
+        "helmet": "^8.1.0",
         "imapflow": "^1.2.8",
         "jsonwebtoken": "^9.0.2",
         "mailparser": "^3.9.3",
@@ -1910,6 +1911,15 @@
         "he": "bin/he"
       }
     },
+    "node_modules/helmet": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/helmet/-/helmet-8.1.0.tgz",
+      "integrity": "sha512-jOiHyAZsmnr8LqoPGmCjYAaiuWwjAPLgY8ZX2XrmHawt99/u1y6RgrZMTeoPfpUbV96HOalYgz1qzkRbw54Pmg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/html-to-text": {
       "version": "9.0.5",
       "resolved": "https://registry.npmjs.org/html-to-text/-/html-to-text-9.0.5.tgz",
diff --git a/backend/package.json b/backend/package.json
index 4f822ba3..72345f2a 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -28,6 +28,7 @@
     "express": "^4.21.1",
     "express-rate-limit": "^8.4.0",
     "express-validator": "^7.2.0",
+    "helmet": "^8.1.0",
     "imapflow": "^1.2.8",
     "jsonwebtoken": "^9.0.2",
     "mailparser": "^3.9.3",