diff --git a/backend/app/main.py b/backend/app/main.py
index d0dc453..366c316 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -234,6 +234,18 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+
+@app.middleware("http")
+async def no_store_api_responses(request, call_next):
+    """Authenticated API data must never be cached by the browser/proxy. Without
+    this, browsers (notably Edge) can heuristically cache GETs like
+    /api/garmin-sync/config and keep showing stale state (e.g. "not connected")
+    until a manual cache clear."""
+    response = await call_next(request)
+    if request.url.path.startswith("/api/"):
+        response.headers["Cache-Control"] = "no-store"
+    return response
+
 app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
 app.include_router(activities.router, prefix="/api/activities", tags=["activities"])
 app.include_router(routes.router, prefix="/api/routes", tags=["routes"])
diff --git a/milevault_export/backend/app/main.py b/milevault_export/backend/app/main.py
index cf38e87..5ed10ab 100644
--- a/milevault_export/backend/app/main.py
+++ b/milevault_export/backend/app/main.py
@@ -216,6 +216,19 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+
+@app.middleware("http")
+async def no_store_api_responses(request, call_next):
+    """Authenticated API data must never be cached by the browser/proxy. Without
+    this, browsers (notably Edge) can heuristically cache GETs like
+    /api/garmin-sync/config and keep showing stale state (e.g. "not connected")
+    until a manual cache clear."""
+    response = await call_next(request)
+    if request.url.path.startswith("/api/"):
+        response.headers["Cache-Control"] = "no-store"
+    return response
+
+
 app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
 app.include_router(activities.router, prefix="/api/activities", tags=["activities"])
 app.include_router(routes.router, prefix="/api/routes", tags=["routes"])