diff --git a/app.py b/app.py
index 30f8990..5caff8a 100644
--- a/app.py
+++ b/app.py
@@ -649,7 +649,10 @@ def audio(token, version):
     path = req.get(field)
     if not path or not Path(path).exists():
         abort(404)
-    return send_from_directory(Path(path).parent, Path(path).name)
+    response = send_from_directory(Path(path).parent, Path(path).name)
+    response.headers['Content-Disposition'] = 'inline'
+    response.headers['X-Content-Type-Options'] = 'nosniff'
+    return response
 
 
 # ---------------------------------------------------------------------------
diff --git a/templates/player.html b/templates/player.html
index 00aacb8..212b252 100644
--- a/templates/player.html
+++ b/templates/player.html
@@ -131,13 +131,13 @@
     <!-- Version A player -->
     <div class="player">
       <h3>Version A</h3>
-      <audio controls src="{{ url_for('audio', token=req.player_token, version='a') }}"></audio>
+      <audio controls controlsList="nodownload" src="{{ url_for('audio', token=req.player_token, version='a') }}"></audio>
     </div>
 
     <!-- Version B player -->
     <div class="player">
       <h3>Version B</h3>
-      <audio controls src="{{ url_for('audio', token=req.player_token, version='b') }}"></audio>
+      <audio controls controlsList="nodownload" src="{{ url_for('audio', token=req.player_token, version='b') }}"></audio>
     </div>
 
     {% if req.status == 'revisions_requested' %}