diff --git a/netlify.toml b/netlify.toml
index c7bd82b..6d0ea41 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -1,2 +1,17 @@
 [build]
   publish = "public"
+  command = "./scripts/netlify.sh"
+
+[build.environment]
+  HUGO_VERSION = "0.52"
+  NODE_ENV = "production"
+  NPM_CONFIG_PRODUCTION = "false"
+
+[[headers]]
+  for = "/*"
+  [headers.values]
+    X-Frame-Options = "SAMEORIGIN"
+    X-XSS-Protection = "1; mode=block"
+    X-Content-Type-Options = "nosniff"
+    Referrer-Policy = "same-origin"
+    Strict-Transport-Security = "max-age=5184000"
diff --git a/scripts/netlify.sh b/scripts/netlify.sh
new file mode 100755
index 0000000..772de8d
--- /dev/null
+++ b/scripts/netlify.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+# https://github.com/netlify/build-image/issues/183#issuecomment-419199649
+
+HUGO_FLAVOUR="hugo_extended"
+
+rm -rf *.deb
+wget --no-clobber http://security.ubuntu.com/ubuntu/pool/main/g/gcc-5/libstdc++6_5.4.0-6ubuntu1~16.04.10_amd64.deb || exit 1
+wget --no-clobber https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${HUGO_FLAVOUR}_${HUGO_VERSION}_Linux-64bit.deb || exit 1
+grep "hugo=" ~/.bashrc || echo "alias hugo='LD_LIBRARY_PATH=$(pwd)/tmp/usr/lib/x86_64-linux-gnu $(pwd)/tmp/usr/local/bin/hugo'" >> ~/.bashrc
+find -name '*.deb' -exec dpkg -x {} $(pwd)/tmp \;
+rm -rf *.deb
+
+export LD_LIBRARY_PATH=$(pwd)/tmp/usr/lib/x86_64-linux-gnu
+export PATH=$(pwd)/tmp/usr/local/bin:$PATH
+
+./scripts/build.sh