diff --git a/docs/itential_platform_guide.md b/docs/itential_platform_guide.md
index e75c0f17..593e02fe 100644
--- a/docs/itential_platform_guide.md
+++ b/docs/itential_platform_guide.md
@@ -212,7 +212,7 @@ located in `roles/platform/defaults/main/webserver.yml`.
 
 | Variable | Type | Description | Default Value |
 | :------- | :--- | :---------- | :------------ |
-| platform_webserver_cache_control_enabled | Boolean | A toggle to instruct the webserver to include HTTP cache control headers on the response. | `false` |
+| platform_webserver_cache_control_enabled | Boolean | A toggle to instruct the webserver to include HTTP cache control headers on the response. If left unset in `platform.properties`, Itential Platform itself defaults this to `false`; the deployer explicitly overrides that default to `true`. | `true` |
 | platform_webserver_timeout | Integer | Timeout to use for incoming HTTP requests to the platform API, in milliseconds. | 300000 |
 | platform_webserver_response_header_access_control_allow_origin | String | The value of the HTTP Access-Control-Allow-Origin header returned to clients. | `"*"` |
 | platform_webserver_http_enabled | Boolean | If true, allows the webserver to respond to insecure HTTP requests. | `true` |
diff --git a/roles/platform/CLAUDE.md b/roles/platform/CLAUDE.md
index efd4d43e..caf6b4fd 100644
--- a/roles/platform/CLAUDE.md
+++ b/roles/platform/CLAUDE.md
@@ -79,7 +79,7 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_webserver_https_port` | `3443` | HTTPS port |
 | `platform_webserver_https_ciphers` | Long cipher list | Allowed TLS ciphers |
 | `platform_webserver_https_secure_protocol` | `TLS_method` | OpenSSL method |
-| `platform_webserver_cache_control_enabled` | `false` | HTTP cache control headers |
+| `platform_webserver_cache_control_enabled` | `true` | HTTP cache control headers. Itential Platform's own application default (when left unset in `platform.properties`) is `false` — the deployer explicitly overrides it to `true`. |
 | `platform_webserver_timeout` | `300000` | Request timeout (ms) |
 
 ### mongodb.yml defaults
diff --git a/roles/platform/defaults/main/webserver.yml b/roles/platform/defaults/main/webserver.yml
index 59e5f03c..9c54c39c 100644
--- a/roles/platform/defaults/main/webserver.yml
+++ b/roles/platform/defaults/main/webserver.yml
@@ -1,8 +1,10 @@
 # Copyright (c) 2024, Itential, Inc
 # GNU General Public License v3.0+ (see LICENSE or https://www.gnu.org/licenses/gpl-3.0.txt)
 ---
-# A toggle to instruct the webserver to include HTTP cache control headers on the response.
-platform_webserver_cache_control_enabled:
+# A toggle to instruct the webserver to include HTTP cache control headers on the response. If
+# left unset in platform.properties, Itential Platform itself defaults this to false; the
+# deployer explicitly overrides that default to true.
+platform_webserver_cache_control_enabled: true
 
 # Timeout to use for incoming HTTP requests to the platform API, in milliseconds.
 platform_webserver_timeout: