diff --git a/tests/test_media_inline.py b/tests/test_media_inline.py
index 64f97cfc..cc087443 100644
--- a/tests/test_media_inline.py
+++ b/tests/test_media_inline.py
@@ -849,6 +849,12 @@ class TestMediaEndpointIntegration(unittest.TestCase):
                 any("sandbox allow-scripts" == h for h in headers.get_all("Content-Security-Policy", []))
             )
             self.assertEqual(body, html_bytes)
+            # HTML responses must use no-store to prevent stale preview on
+            # re-send of the same MEDIA: link (attachment branch).
+            self.assertEqual(
+                headers.get("Cache-Control"), "no-store",
+                "HTML attachment must use Cache-Control: no-store"
+            )
 
             body, status, headers = self._get(f"/api/media?path={encoded}&inline=1")
             self.assertEqual(status, 200)
@@ -859,6 +865,11 @@ class TestMediaEndpointIntegration(unittest.TestCase):
                 any("sandbox allow-scripts" == h for h in headers.get_all("Content-Security-Policy", []))
             )
             self.assertEqual(body, html_bytes)
+            # Inline HTML preview must also use no-store (inline branch).
+            self.assertEqual(
+                headers.get("Cache-Control"), "no-store",
+                "Inline HTML preview must use Cache-Control: no-store"
+            )
         finally:
             pathlib.Path(tmp_path).unlink(missing_ok=True)
 
diff --git a/tests/test_pdf_html_preview.py b/tests/test_pdf_html_preview.py
index 57fe4119..53f0cfcd 100644
--- a/tests/test_pdf_html_preview.py
+++ b/tests/test_pdf_html_preview.py
@@ -197,7 +197,10 @@ class TestLoadHtmlInlineFunction:
         body = ui[idx:idx + 1200]
         assert 'const mediaSessionId=' in body
         assert "'&session_id='+encodeURIComponent(mediaSessionId)" in body
-        assert 'fetch(mediaUrl' in body
+        assert "fetch(mediaUrl, {cache:'no-store'})" in body, (
+            "loadHtmlInline must fetch with cache:'no-store' to bypass "
+            "browser cache for stale HTML preview (got body without no-store)"
+        )
         assert "const publicMediaUrl='api/media?path='+encodeURIComponent(path);" in body
         assert "const openUrl=publicMediaUrl+'&inline=1';" in body