diff --git a/server/src/WebDrop.Api/WebDropApp.cs b/server/src/WebDrop.Api/WebDropApp.cs
index 9f5b349..46364c4 100644
--- a/server/src/WebDrop.Api/WebDropApp.cs
+++ b/server/src/WebDrop.Api/WebDropApp.cs
@@ -55,6 +55,9 @@ public static class WebDropApp
             sp.GetRequiredService<IResourceStore>(), sp.GetRequiredService<IBlobStore>(), sp.GetRequiredService<IClock>(),
             options.Limits, options.ShareDraftTtlSeconds));
         builder.Services.AddHostedService<SweepWorker>();
+        // JSON(如 crypto 状态)与前端静态资源压缩后再传;认证走请求头而非 cookie,开启 HTTPS 压缩不会带来 BREACH 风险。
+        // 默认 MIME 列表不含 text/event-stream 与 octet-stream,日志流和密文不受影响
+        builder.Services.AddResponseCompression(o => o.EnableForHttps = true);
 
         if (options.CorsOrigins.Length > 0)
         {
@@ -99,6 +102,7 @@ public static class WebDropApp
             });
         }
 
+        app.UseResponseCompression();
         app.Use(SecurityHeaders);
         app.Use(HandleErrors);
         if (options.CorsOrigins.Length > 0) app.UseCors();