diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.kojipkgs.conf b/roles/httpd/reverseproxy/templates/reversepassproxy.kojipkgs.conf
index c47da108d2..aededdb6cc 100644
--- a/roles/httpd/reverseproxy/templates/reversepassproxy.kojipkgs.conf
+++ b/roles/httpd/reverseproxy/templates/reversepassproxy.kojipkgs.conf
@@ -1,5 +1,18 @@
 {% if rewrite %}
 RewriteEngine On
+
+# Make sure that CloudFront does not cache ostree summary or refs files.
+# These should always be requested directly from Fedora, so any user directly
+#  hitting a cloudfront setup should update their configuration.
+RewriteCond %{HTTP:X-Amz-Cf-Id} !^$
+RewriteRule ^/atomic/repo/summary - [F]
+RewriteCond %{HTTP:X-Amz-Cf-Id} !^$
+RewriteRule ^/atomic/repo/refs - [F]
+RewriteCond %{HTTP:X-Amz-Cf-Id} !^$
+RewriteRule ^/ostree/repo/summary - [F]
+RewriteCond %{HTTP:X-Amz-Cf-Id} !^$
+RewriteRule ^/ostree/repo/refs - [F]
+
 RewriteRule ^{{remotepath}}$ %{REQUEST_URI}/ [R=301]
 
 {% endif %}