diff --git a/app.js b/app.js
index b935306d..34a4e1a7 100644
--- a/app.js
+++ b/app.js
@@ -156,6 +156,13 @@ app.use(cookieParser())
 app.use(i18n.init)
 
 // routes without sessions
+// security headers for uploads
+app.use('/uploads', (req, res, next) => {
+  res.set('Content-Disposition', 'attachment')
+  res.set('Content-Security-Policy', "default-src 'none'")
+  next()
+})
+
 // static files
 app.use('/', express.static(path.join(__dirname, '/public'), {
   maxAge: config.staticCacheTime,
@@ -166,13 +173,6 @@ app.use('/docs', express.static(path.resolve(__dirname, config.docsPath), {
   maxAge: config.staticCacheTime,
   redirect: false
 }))
-// This is done by an additional middleware, instead of setHeaders of express.static, because for what ever reason
-// the latter did not work
-app.use('/uploads', (req, res, next) => {
-  res.set('Content-Disposition', 'attachment')
-  res.set('Content-Security-Policy', "default-src 'none'")
-  next()
-})
 app.use('/uploads', express.static(path.resolve(__dirname, config.uploadsPath), {
   maxAge: config.staticCacheTime,
   redirect: false