diff --git a/html/live/index.html b/html/live/index.html
index 05e279e..3257536 100644
--- a/html/live/index.html
+++ b/html/live/index.html
@@ -7,7 +7,7 @@
   <meta name="description" content="100 systems shipped. Every deployment, every fix — logged live from production.">
   <meta property="og:title" content="QuikCue — Live Build Log">
   <meta property="og:description" content="100 systems shipped. Real-time production log. Full transparency.">
-  <link rel="canonical" href="https://quikcue.com/live">
+  <link rel="canonical" href="https://quikcue.com/live/">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700;800&family=Inter:wght@300;400;500;600;700;800;900&display=swap" rel="stylesheet">
diff --git a/html/pricing/index.html b/html/pricing/index.html
index 432b72f..8170dcf 100644
--- a/html/pricing/index.html
+++ b/html/pricing/index.html
@@ -10,7 +10,7 @@
   <meta property="og:type" content="website">
   <meta property="og:url" content="https://quikcue.com/pricing">
   <meta name="twitter:card" content="summary_large_image">
-  <link rel="canonical" href="https://quikcue.com/pricing">
+  <link rel="canonical" href="https://quikcue.com/pricing/">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700;800&family=Inter:wght@300;400;500;600;700;800;900&display=swap" rel="stylesheet">
diff --git a/html/robots.txt b/html/robots.txt
new file mode 100644
index 0000000..76ce7ad
--- /dev/null
+++ b/html/robots.txt
@@ -0,0 +1,6 @@
+User-agent: *
+Allow: /
+Disallow: /api/
+
+Sitemap: https://quikcue.com/sitemap.xml
+Sitemap: https://quikcue.com/blog/sitemap.xml
diff --git a/html/sitemap.xml b/html/sitemap.xml
new file mode 100644
index 0000000..abd7c34
--- /dev/null
+++ b/html/sitemap.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+  <url>
+    <loc>https://quikcue.com</loc>
+    <lastmod>2026-03-07</lastmod>
+    <changefreq>weekly</changefreq>
+    <priority>1.0</priority>
+  </url>
+  <url>
+    <loc>https://quikcue.com/pricing/</loc>
+    <lastmod>2026-03-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://quikcue.com/live/</loc>
+    <lastmod>2026-03-07</lastmod>
+    <changefreq>daily</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://quikcue.com/work/charityright/</loc>
+    <lastmod>2026-03-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://quikcue.com/blog/</loc>
+    <lastmod>2026-03-07</lastmod>
+    <changefreq>weekly</changefreq>
+    <priority>0.6</priority>
+  </url>
+</urlset>
diff --git a/html/work/charityright/index.html b/html/work/charityright/index.html
index 183aa8d..30c854a 100644
--- a/html/work/charityright/index.html
+++ b/html/work/charityright/index.html
@@ -10,7 +10,7 @@
   <meta property="og:type" content="article">
   <meta property="og:url" content="https://quikcue.com/work/charityright">
   <meta name="twitter:card" content="summary_large_image">
-  <link rel="canonical" href="https://quikcue.com/work/charityright">
+  <link rel="canonical" href="https://quikcue.com/work/charityright/">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700;800&family=Inter:wght@300;400;500;600;700;800;900&display=swap" rel="stylesheet">
diff --git a/nginx.conf b/nginx.conf
index 69b5ace..534839c 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -1,11 +1,22 @@
 server {
     listen 80;
-    server_name quikcue.com www.quikcue.com;
+    server_name www.quikcue.com;
+    return 301 https://quikcue.com$request_uri;
+}
+
+server {
+    listen 80;
+    server_name quikcue.com;
     root /usr/share/nginx/html;
     index index.html;
 
     absolute_redirect off;
 
+    # Redirect /work/ to first case study (no bare index = was 403)
+    location = /work/ {
+        return 301 /work/charityright/;
+    }
+
     location / {
         try_files $uri $uri/ $uri/index.html /index.html;
     }
@@ -18,6 +29,7 @@ server {
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
 
     gzip on;
     gzip_types text/html text/css application/javascript text/plain;