diff --git a/backend/app.py b/backend/app.py
index 1293460a..b19d1bf4 100644
--- a/backend/app.py
+++ b/backend/app.py
@@ -135,7 +135,7 @@ def _mount_frontend(application: FastAPI) -> None:
     async def serve_spa(full_path: str):
         file_path = (frontend_dir / full_path).resolve()
         # Guard against path traversal — only serve files inside frontend_dir
-        if full_path and file_path.is_file() and str(file_path).startswith(str(frontend_dir)):
+        if full_path and file_path.is_file() and file_path.is_relative_to(frontend_dir):
             return FileResponse(file_path)
         return FileResponse(frontend_dir / "index.html", media_type="text/html")
 
diff --git a/backend/utils/cache.py b/backend/utils/cache.py
index cace2bdd..dd4b9f83 100644
--- a/backend/utils/cache.py
+++ b/backend/utils/cache.py
@@ -64,7 +64,7 @@ def get_cached_voice_prompt(
     cache_file = _get_cache_dir() / f"{cache_key}.prompt"
     if cache_file.exists():
         try:
-            prompt = torch.load(cache_file)
+            prompt = torch.load(cache_file, weights_only=True)
             _memory_cache[cache_key] = prompt
             return prompt
         except Exception: