diff --git a/app/__init__.py b/app/__init__.py
index d57c238..1c783fe 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -93,7 +93,8 @@ def create_app(config=None):
         response.headers["X-Frame-Options"] = "DENY"
         response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
         if request.path.startswith("/shared/runs/"):
-            response.headers["Referrer-Policy"] = "no-referrer"
+            # OSM tiles require a Referer; never include the share token in it.
+            response.headers["Referrer-Policy"] = "strict-origin"
             response.headers["X-Robots-Tag"] = "noindex, nofollow"
         return response
 
diff --git a/tests/test_app.py b/tests/test_app.py
index d75a801..78269e3 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -173,7 +173,7 @@ def test_public_run_link_copy_view_revoke_and_recreate(app):
     assert b"/u/runner" not in page.data
     assert (url.removeprefix("http://localhost") + "/data").encode() in page.data
     assert page.headers["X-Robots-Tag"] == "noindex, nofollow"
-    assert page.headers["Referrer-Policy"] == "no-referrer"
+    assert page.headers["Referrer-Policy"] == "strict-origin"
     data = anonymous.get(url + "/data")
     assert data.status_code == 200
     assert data.json["segments"] == [[[-33, 151]]]