diff --git a/xCAT/xCAT.spec b/xCAT/xCAT.spec
index 57031a8b5..93fc46571 100644
--- a/xCAT/xCAT.spec
+++ b/xCAT/xCAT.spec
@@ -225,6 +225,13 @@ then
    cp /etc/%httpconfigdir/conf.orig/xcat.conf.apach24 /etc/apache2/conf.d/xcat.conf
 fi
 
+# On SUSE apache2, mod_headers is not loaded by default; enable it so the
+# security response headers in xcat.conf take effect (a no-op where a2enmod
+# is absent, e.g. httpd on EL where mod_headers is already loaded).
+if [ -e /etc/apache2/conf.d/xcat.conf ] && command -v a2enmod >/dev/null 2>&1; then
+    a2enmod headers >/dev/null 2>&1 || :
+fi
+
 # Let rsyslogd perform close of any open files
 if [ -e /var/run/rsyslogd.pid ]; then
     kill -HUP $(</var/run/rsyslogd.pid) >/dev/null 2>&1 || :
diff --git a/xCATsn/xCATsn.spec b/xCATsn/xCATsn.spec
index c69e43643..9735e958c 100644
--- a/xCATsn/xCATsn.spec
+++ b/xCATsn/xCATsn.spec
@@ -169,6 +169,13 @@ if [ -n "$version" ]; then
     fi
 fi
 
+# On SUSE apache2, mod_headers is not loaded by default; enable it so the
+# security response headers in xcat.conf take effect (a no-op where a2enmod
+# is absent, e.g. httpd on EL where mod_headers is already loaded).
+if [ -e /etc/apache2/conf.d/xcat.conf ] && command -v a2enmod >/dev/null 2>&1; then
+    a2enmod headers >/dev/null 2>&1 || :
+fi
+
 
 # Let rsyslogd perform close of any open files
 if [ -e /var/run/rsyslogd.pid ]; then