How to add Security Headers to Cloudflare Pages project/site

I love Cloudflare Pages, especially the unlimited bandwidth which means I can handoff sites to clients and they don’t have to worry about costs if they go viral.

But I’ve just found out that there is no way to add HTTP security headers (like CSP) other than using Cloudflare Workers. This means that any useage is capped and limited by the free tier of Cloudflare Workers.

I cannot believe this is a limit for anotherwise great product, and it is a deal breaker.

Any ideas or input would be greatly appreciated.