diff --git a/scripts/dossiers-ngi/README.md b/scripts/dossiers-ngi/README.md
index 3e1f39f..9cbf39b 100644
--- a/scripts/dossiers-ngi/README.md
+++ b/scripts/dossiers-ngi/README.md
@@ -103,6 +103,8 @@ Each name links to `/_cascade/use/<edition>` (cookie + 302 `/`). Caddy map:
 
 Also serve `/cascade/*` from the site www root (path stubs). Live Caddy must not use a trailing `~.* flask` catch-all.
 
+Edition purity: responses send `Vary: Cookie` and `Cache-Control: private, no-cache` so `/static/css/style.css` (same path, different bodies per edition) cannot stick the green design CSS onto `main` after a views visit.
+
 so new branches need no Caddy edit — only an `editions/<slug>/` tree.
 
 ```bash
diff --git a/scripts/dossiers-ngi/caddy-dossiers-ngi.snippet b/scripts/dossiers-ngi/caddy-dossiers-ngi.snippet
index 026fae3..3641e72 100644
--- a/scripts/dossiers-ngi/caddy-dossiers-ngi.snippet
+++ b/scripts/dossiers-ngi/caddy-dossiers-ngi.snippet
@@ -10,26 +10,34 @@
 # Site-block body (no outer braces):
 
 	header Alt-Svc "clear"
+	# Cookie selects editions/<slug>/; same paths (/static/css/style.css) must not
+	# share one browser/CDN cache entry across editions (main has no green CSS).
+	header Vary "Cookie"
+	header Cache-Control "private, no-cache"
 
 	@use path_regexp use ^/_cascade/use/([A-Za-z0-9_-]+)/?$
 	handle @use {
 		header Set-Cookie "tdpd_edition={re.use.1}; Path=/; Max-Age=31536000; SameSite=Lax"
+		header Cache-Control "private, no-store"
 		redir * / 302
 	}
 
 	handle /_cascade/* {
 		root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch
+		header Cache-Control "private, no-cache"
 		file_server
 	}
 	# Path-root cascade stubs (feat-website-views, …) live under sites/…/cascade/
 	# and must not fall through to editions/{cookie}/ (that yields 404).
 	handle /cascade/* {
 		root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch
+		header Cache-Control "private, no-cache"
 		file_server
 		try_files {path} {path}/ {path}/index.html
 	}
 	handle /branch-status.json {
 		root * /var/www/monitoring-sites/dossiers.ngi.hacktivism.ch
+		header Cache-Control "private, no-cache"
 		file_server
 	}