diff --git a/src/api/s3_copy.rs b/src/api/s3_copy.rs
index 5997e4fe..d764f7a8 100644
--- a/src/api/s3_copy.rs
+++ b/src/api/s3_copy.rs
@@ -103,5 +103,7 @@ pub async fn handle_copy(
 	writeln!(&mut xml, "\t<LastModified>{}</LastModified>", last_modified).unwrap();
 	writeln!(&mut xml, "</CopyObjectResult>").unwrap();
 
-	Ok(Response::new(Body::from(xml.into_bytes())))
+	Ok(Response::builder()
+	   .header("Content-Type", "application/xml")
+	   .body(Body::from(xml.into_bytes()))?)
 }
diff --git a/src/api/s3_delete.rs b/src/api/s3_delete.rs
index f46bfcfe..b019987b 100644
--- a/src/api/s3_delete.rs
+++ b/src/api/s3_delete.rs
@@ -86,7 +86,7 @@ pub async fn handle_delete_objects(
 		match handle_delete_internal(&garage, bucket, &obj.key).await {
 			Ok((deleted_version, delete_marker_version)) => {
 				writeln!(&mut retxml, "\t<Deleted>").unwrap();
-				writeln!(&mut retxml, "\t\t<Key>{}</Key>", obj.key).unwrap();
+				writeln!(&mut retxml, "\t\t<Key>{}</Key>", xml_escape(&obj.key)).unwrap();
 				writeln!(
 					&mut retxml,
 					"\t\t<VersionId>{}</VersionId>",
@@ -104,7 +104,7 @@ pub async fn handle_delete_objects(
 			Err(e) => {
 				writeln!(&mut retxml, "\t<Error>").unwrap();
 				writeln!(&mut retxml, "\t\t<Code>{}</Code>", e.http_status_code()).unwrap();
-				writeln!(&mut retxml, "\t\t<Key>{}</Key>", obj.key).unwrap();
+				writeln!(&mut retxml, "\t\t<Key>{}</Key>", xml_escape(&obj.key)).unwrap();
 				writeln!(
 					&mut retxml,
 					"\t\t<Message>{}</Message>",
@@ -118,7 +118,9 @@ pub async fn handle_delete_objects(
 
 	writeln!(&mut retxml, "</DeleteObjectsOutput>").unwrap();
 
-	Ok(Response::new(Body::from(retxml.into_bytes())))
+	Ok(Response::builder()
+	   .header("Content-Type", "application/xml")
+	   .body(Body::from(retxml.into_bytes()))?)
 }
 
 struct DeleteRequest {
diff --git a/src/api/s3_list.rs b/src/api/s3_list.rs
index 39ede3e2..2be47091 100644
--- a/src/api/s3_list.rs
+++ b/src/api/s3_list.rs
@@ -271,5 +271,7 @@ pub async fn handle_list(
 	writeln!(&mut xml, "</ListBucketResult>").unwrap();
 	debug!("{}", xml);
 
-	Ok(Response::new(Body::from(xml.into_bytes())))
+	Ok(Response::builder()
+	   .header("Content-Type", "application/xml")
+	   .body(Body::from(xml.into_bytes()))?)
 }