diff --git a/bskyweb/cmd/embedr/server.go b/bskyweb/cmd/embedr/server.go
index a5645b361b..0cea71ae79 100644
--- a/bskyweb/cmd/embedr/server.go
+++ b/bskyweb/cmd/embedr/server.go
@@ -96,7 +96,7 @@ func serve(cctx *cli.Context) error {
 	// SECURITY: Do not modify without due consideration.
 	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
 		ContentTypeNosniff: "nosniff",
-		XFrameOptions:      "SAMEORIGIN",
+		// diable XFrameOptions; we're embedding here!
 		HSTSMaxAge:         31536000, // 365 days
 		// TODO:
 		// ContentSecurityPolicy