diff --git a/packages/server/src/server.js b/packages/server/src/server.js
index 70c734dd25..516af98083 100644
--- a/packages/server/src/server.js
+++ b/packages/server/src/server.js
@@ -114,6 +114,12 @@ export default class Server {
         if (!this.devMiddleware) {
           return next()
         }
+        // Safari over-caches JS (breaking HMR) and the seemingly only way to turn
+        // this off in dev mode is to set Vary: * header
+        // #3828, #9034
+        if (req.url.startsWith(this.publicPath) && req.url.endsWith('.js')) {
+          res.setHeader('Vary', '*')
+        }
         this.devMiddleware(req, res, next)
       })