diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3719247..6176295 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to this project are recorded here. The format follows [Keep
 
 ## [Unreleased]
 
+### Fixed
+
+- Sign-in refused as cross-origin in Firefox: the app sent `Referrer-Policy: no-referrer`, under which Firefox sends `Origin: null` on same-origin POSTs. The policy is now `same-origin`, which still sends nothing to other sites.
+
 ### Added
 
 - Phase 5: the shop. The Supervisor screen (department chips for people who lead several departments, the change-order headline that cannot be closed, the numbers Ready to assign, At stations, Waiting on review and Station hours vs target, the Change orders on hold table, the station grid with a tile per station showing the job, the welder and stamp, the ticking clock against the target hours and a CHANGE ORDER tag, and the boards Ready to assign, Waiting on review, At Q.C., With warehouse and Routed on) and the Stall screen (station picker, the station hero, My packets and Submitted, waiting on supervisor).
diff --git a/server/packetstation/security.py b/server/packetstation/security.py
index 848410a..2b77867 100644
--- a/server/packetstation/security.py
+++ b/server/packetstation/security.py
@@ -27,7 +27,8 @@ HEADERS: dict[str, str] = {
     "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
     "X-Content-Type-Options": "nosniff",
     "X-Frame-Options": "DENY",
-    "Referrer-Policy": "no-referrer",
+    # Not no-referrer: under it Firefox sends Origin: null on same-origin POSTs and the Origin check refuses them.
+    "Referrer-Policy": "same-origin",
     "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
     "Cross-Origin-Opener-Policy": "same-origin",
     "Content-Security-Policy": CSP,
diff --git a/tests/server/test_app.py b/tests/server/test_app.py
index 3faf8ae..d2f0205 100644
--- a/tests/server/test_app.py
+++ b/tests/server/test_app.py
@@ -19,7 +19,7 @@ EXPECTED = {
     "strict-transport-security": "max-age=31536000; includeSubDomains",
     "x-content-type-options": "nosniff",
     "x-frame-options": "DENY",
-    "referrer-policy": "no-referrer",
+    "referrer-policy": "same-origin",
     "permissions-policy": "camera=(), microphone=(), geolocation=()",
     "cross-origin-opener-policy": "same-origin",
 }