diff --git a/routstr/core/main.py b/routstr/core/main.py
index 3001e56b..c9598a1c 100644
--- a/routstr/core/main.py
+++ b/routstr/core/main.py
@@ -264,6 +264,12 @@ app.add_middleware(
         "x-routstr-cost-usd",
         "x-routstr-input-cost-msats",
         "x-routstr-output-cost-msats",
+        # EHBP (Tinfoil) protocol headers must be exposed so browser clients
+        # can detect and decrypt encrypted responses. Without these, the
+        # browser hides them via CORS and the SDK treats the response as a
+        # plaintext proxy error, returning raw ciphertext.
+        "Ehbp-Response-Nonce",
+        "Ehbp-Encapsulated-Key",
     ],
 )