diff --git a/internal/transport/httpserver/server_test.go b/internal/transport/httpserver/server_test.go
index 4d5ec92..4387f82 100644
--- a/internal/transport/httpserver/server_test.go
+++ b/internal/transport/httpserver/server_test.go
@@ -26,7 +26,7 @@ func TestVersionIsPublicAndBounded(t *testing.T) {
 	server := New("127.0.0.1:0", nil)
 	rr := httptest.NewRecorder()
 	server.Handler.ServeHTTP(rr, httptest.NewRequest(http.MethodGet, "/version", nil))
-	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), `"http_protocol_version":"1"`) || strings.Contains(rr.Body.String(), "ORBIT_MYSQL_DSN") {
+	if rr.Code != http.StatusOK || rr.Header().Get("Cache-Control") != "no-store" || rr.Header().Get("X-Content-Type-Options") != "nosniff" || rr.Header().Get("Content-Type") != "application/json" || !strings.Contains(rr.Body.String(), `"http_protocol_version":"1"`) || strings.Contains(rr.Body.String(), "ORBIT_MYSQL_DSN") {
 		t.Fatalf("unexpected version response: %d %s", rr.Code, rr.Body.String())
 	}
 }
diff --git a/sdk/go/client_test.go b/sdk/go/client_test.go
index ce8772d..b0602d5 100644
--- a/sdk/go/client_test.go
+++ b/sdk/go/client_test.go
@@ -76,3 +76,36 @@ func TestRejectsUnsafeURLsRedirectsAndOversizedResponses(t *testing.T) {
 		})
 	}
 }
+
+func TestVersionRejectsHTTPErrorAndOversizedResponse(t *testing.T) {
+	for _, scenario := range []string{"status", "oversize"} {
+		t.Run(scenario, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path != "/version" {
+					t.Fatalf("unexpected path %s", r.URL.Path)
+				}
+				if scenario == "status" {
+					w.WriteHeader(http.StatusServiceUnavailable)
+					_, _ = w.Write([]byte(`{"secret":"must not appear"}`))
+					return
+				}
+				_, _ = w.Write([]byte(strings.Repeat("x", 17000)))
+			}))
+			defer server.Close()
+			client, err := orbit.NewClient(server.URL, orbit.Options{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			_, err = client.Version(context.Background())
+			if err == nil || strings.Contains(err.Error(), "secret") {
+				t.Fatalf("unsafe version error: %v", err)
+			}
+			if scenario == "status" {
+				var status *orbit.HTTPError
+				if !errors.As(err, &status) || status.StatusCode != http.StatusServiceUnavailable {
+					t.Fatalf("status error=%v", err)
+				}
+			}
+		})
+	}
+}