diff --git a/apps/docs-ophis/static/_redirects b/apps/docs-ophis/static/_redirects
index 151bc1c0..d5e70386 100644
--- a/apps/docs-ophis/static/_redirects
+++ b/apps/docs-ophis/static/_redirects
@@ -4,3 +4,11 @@
 # /api was a dead path (404). The Intent API reference lives at /intent-api.
 /api      /intent-api   301
 /api/     /intent-api   301
+
+# /institutional and /brand are NOT docs pages: they are swap-app HashRouter
+# routes (swap.ophis.fi/#/institutional, /#/brand). Google indexed stale
+# docs.ophis.fi/{institutional,brand} URLs from old links and flagged them 404
+# (GSC, 2026-06). 301 them to their real homes on the swap app. (If CF drops the
+# fragment, the target still resolves to the live swap home, so never a 404.)
+/institutional   https://swap.ophis.fi/#/institutional   301
+/brand           https://swap.ophis.fi/#/brand           301
diff --git a/apps/rebate-indexer/src/api.ts b/apps/rebate-indexer/src/api.ts
index e830ebe9..2bc1e341 100644
--- a/apps/rebate-indexer/src/api.ts
+++ b/apps/rebate-indexer/src/api.ts
@@ -155,6 +155,19 @@ export async function buildApiServer(): Promise<FastifyInstance> {
   });
   app.options('*', async (_req, reply) => reply.code(204).send());
 
+  // rebates.ophis.fi is the rebate-indexer API host (JSON endpoints + the
+  // per-wallet /tier HTML page). None of it is meant for search indexing, and
+  // Google was crawling the bare host root and flagging it 404 (GSC, 2026-06).
+  // Tell crawlers to stay off the whole host. Permissive rate limit: robots.txt
+  // is fetched freely by crawlers and is harmless.
+  app.get('/robots.txt', {
+    config: {
+      rateLimit: { max: 200, timeWindow: '1 minute' },
+    },
+  }, async (_req, reply) =>
+    reply.code(200).type('text/plain; charset=utf-8').send('User-agent: *\nDisallow: /\n'),
+  );
+
   app.get('/health', {
     config: {
       rateLimit: { max: 200, timeWindow: '1 minute' }, // permissive — uptime monitors hit this continuously