diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index 4d9dd43e9f5..24db8bf8301 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-7611
\ No newline at end of file
+7612
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/Bugzilla/CGI.pm b/mozilla/webtools/bugzilla/Bugzilla/CGI.pm
index 8ec3ac28e8a..b32f76ae01b 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/CGI.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/CGI.pm
@@ -275,9 +275,13 @@ sub header {
 
     # Add Strict-Transport-Security (STS) header if this response
     # is over SSL and the strict_transport_security param is turned on.
-    if ($self->https && Bugzilla->params->{'strict_transport_security'} ne 'off') {
+    if ($self->https && !$self->url_is_attachment_base
+        && Bugzilla->params->{'strict_transport_security'} ne 'off') 
+    {
         my $sts_opts = 'max-age=' . MAX_STS_AGE;
-        if (Bugzilla->params->{'strict_transport_security'} eq 'include_subdomains') {
+        if (Bugzilla->params->{'strict_transport_security'} 
+            eq 'include_subdomains')
+        {
             $sts_opts .= '; includeSubDomains';
         }
         unshift(@_, '-strict_transport_security' => $sts_opts);