Index: src/server.js
===================================================================
--- src/server.js	(revision f1c50f9e8909d1873e736e05e5b2cb0c167154ba)
+++ src/server.js	(revision 6089c53ce58d9a815c32fa7f8ddb549efce96d68)
@@ -264,4 +264,12 @@
   // refuses to render it). Set cross-origin explicitly for /media.
   setHeaders: (res) => res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin'),
+  // An upload never changes under its name (unique filenames; a new upload is
+  // a new name), so say so. Without this the default is max-age=0 and every
+  // platform image-loader may re-ask for every image on every screen: Shaer's
+  // cards visibly re-loaded what the previous view had just shown. The thumbs
+  // and the avatar proxy already declared this; the originals were the one
+  // place that forgot.
+  maxAge: isDev ? 0 : '1y',
+  immutable: !isDev,
 }));