diff --git a/bin/browserid b/bin/browserid
index 1ac097f9bfa5842e209025685760ed123251db71..11a87fdbbfb25d88ab22ac526534bd41fe53d9c4 100755
--- a/bin/browserid
+++ b/bin/browserid
@@ -168,6 +168,13 @@ shutdown.installUpdateHandler(app, function(readyForShutdown) {
   db.close(readyForShutdown)
 });
 
+// #11.5 - custom 404
+app.use(function(req, res,next) {
+  res.statusCode = 404;
+  res.write("Cannot find this resource");
+  res.end();
+});
+
 // #12 if the BROWSERID_FAKE_VERIFICATION env var is defined, we'll include
 // fake_verification.js.  This is used during testing only and should
 // never be included in a production deployment
diff --git a/bin/verifier b/bin/verifier
index 8b80606b5300defa57295203159ac78133bdfa93..57edb054066c1851fc40d3cf7c23083955792075 100755
--- a/bin/verifier
+++ b/bin/verifier
@@ -123,6 +123,13 @@ app.post('/verify', function(req, resp, next) {
 // shutdown when /code_update is invoked
 shutdown.installUpdateHandler(app);
 
+// custom 404
+app.use(function(req, res,next) {
+  res.statusCode = 404;
+  res.write("Cannot find this resource");
+  res.end();
+});
+
 // shutdown nicely on signals
 shutdown.handleTerminationSignals(app);