diff --git a/nginx/default.conf b/nginx/default.conf
index c650692..12103e7 100644
--- a/nginx/default.conf
+++ b/nginx/default.conf
@@ -15,6 +15,9 @@ server {
             application/javascript js;
         }
         add_header Cache-Control "public, max-age=31536000, immutable" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+        add_header Cross-Origin-Embedder-Policy "require-corp" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
         try_files $uri =404;
     }
 
diff --git a/piper-runtime.js b/piper-runtime.js
index f4ba381..82e606d 100644
--- a/piper-runtime.js
+++ b/piper-runtime.js
@@ -20,7 +20,19 @@ function getWorker() {
     }
   };
   worker.onerror = event => {
-    const error = new Error(event.message || 'Piper-arbetaren kunde inte startas.');
+    const details = [event.message, event.filename && `${event.filename}:${event.lineno || 0}:${event.colno || 0}`]
+      .filter(Boolean)
+      .join(' — ');
+    const error = new Error(details
+      ? `Piper-arbetaren kunde inte startas: ${details}`
+      : 'Piper-arbetaren kunde inte startas.');
+    for (const request of pending.values()) request.reject(error);
+    pending.clear();
+    worker?.terminate();
+    worker = null;
+  };
+  worker.onmessageerror = () => {
+    const error = new Error('Piper-arbetaren skickade ett oläsbart svar.');
     for (const request of pending.values()) request.reject(error);
     pending.clear();
     worker?.terminate();
diff --git a/scripts/check-frontend.sh b/scripts/check-frontend.sh
index 4f6badd..6a704dc 100755
--- a/scripts/check-frontend.sh
+++ b/scripts/check-frontend.sh
@@ -8,6 +8,8 @@ grep -q '<script src="/voice.js?v=__FRONTEND_VERSION__"></script>' index.html
 grep -q '<script src="/piper-runtime.js?v=__FRONTEND_VERSION__"></script>' index.html
 grep -q 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0' nginx/default.conf
 grep -q 'Cross-Origin-Embedder-Policy "require-corp"' nginx/default.conf
+grep -q 'add_header Cross-Origin-Embedder-Policy "require-corp" always;' nginx/default.conf
+grep -q 'add_header Cross-Origin-Resource-Policy "same-origin" always;' nginx/default.conf
 grep -q 'application/javascript js;' nginx/default.conf
 grep -q "request('/version')" index.html
 grep -Fq "credentials: 'same-origin'" index.html
@@ -43,6 +45,7 @@ grep -q 'Piper' piper-runtime.js
 grep -q 'sv_SE-nst-medium' piper-worker.js
 grep -q 'new Worker(workerUrl)' piper-runtime.js
 grep -q 'worker.js?v=' piper-runtime.js
+grep -q 'worker.onmessageerror' piper-runtime.js
 grep -q "SpeechRecognition || win.webkitSpeechRecognition" voice.js
 grep -q "submitMessage(text, 'voice')" index.html
 grep -q 'Spelets repliker läses alltid upp' index.html