diff --git a/app/src/web/routes.rs b/app/src/web/routes.rs
index 4296bec..d7b36bc 100644
--- a/app/src/web/routes.rs
+++ b/app/src/web/routes.rs
@@ -95,7 +95,10 @@ pub(super) async fn init_static_routes() -> Result<Router> {
             .push(
                 Router::with_path("{*path}")
                     .hoop(compression)
-                    .get(static_embed::<ClientAssets>().fallback("index.html")),
+                    // Only "/" maps to the app; the frontend has no client-side
+                    // routes, so unknown paths (and /favicon.ico) get a 404
+                    // rather than index.html served as every file.
+                    .get(static_embed::<ClientAssets>().defaults("index.html")),
             )
     };
     Ok(router)
diff --git a/crates/rkvm-web/index.html b/crates/rkvm-web/index.html
index 2910191..0de0365 100644
--- a/crates/rkvm-web/index.html
+++ b/crates/rkvm-web/index.html
@@ -4,6 +4,7 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
     <title>rustkvm</title>
+    <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16'%3E%3Crect x='1' y='2' width='14' height='10' rx='2' fill='%234f8cff'/%3E%3Crect x='5' y='13' width='6' height='1.5' rx='.75' fill='%234f8cff'/%3E%3C/svg%3E" />
     <link data-trunk rel="rust" data-wasm-opt="z" />
     <script src="https://cdn.jsdelivr.net/npm/tesseract.js@5/dist/tesseract.min.js"></script>
     <script>