diff --git a/web/app/themes/gds/app/Providers/ContentSecurityPolicyServiceProvider.php b/web/app/themes/gds/app/Providers/ContentSecurityPolicyServiceProvider.php
index 9cdeabd2..9f5205a6 100644
--- a/web/app/themes/gds/app/Providers/ContentSecurityPolicyServiceProvider.php
+++ b/web/app/themes/gds/app/Providers/ContentSecurityPolicyServiceProvider.php
@@ -42,7 +42,9 @@ public function sendHeaders(): void
         );
 
         // Force client-side TLS (Transport Layer Security) redirection.
-        header('Strict-Transport-Security: max-age=63072000; includeSubDomains; preload');
+        // No 'preload': submitting the domain to the browser preload lists
+        // is practically irreversible and has to be a deliberate decision.
+        header('Strict-Transport-Security: max-age=63072000; includeSubDomains');
 
         // Disable content sniffing, since it's an attack vector.
         header('X-Content-Type-Options: nosniff');