diff --git a/app/controllers/projects/avatars_controller.rb b/app/controllers/projects/avatars_controller.rb
index b64dbbd89ce..6de7888888f 100644
--- a/app/controllers/projects/avatars_controller.rb
+++ b/app/controllers/projects/avatars_controller.rb
@@ -7,6 +7,8 @@ class Projects::AvatarsController < Projects::ApplicationController
     @blob = @repository.blob_at_branch('master', @project.avatar_in_git)
     if @blob
       headers['X-Content-Type-Options'] = 'nosniff'
+      set_cache_headers
+      check_etag!
       headers.store(*Gitlab::Workhorse.send_git_blob(@repository, @blob))
       headers['Content-Disposition'] = 'inline'
       headers['Content-Type'] = safe_content_type(@blob)
diff --git a/app/controllers/projects/raw_controller.rb b/app/controllers/projects/raw_controller.rb
index d9723acb1d9..b6ff08262d7 100644
--- a/app/controllers/projects/raw_controller.rb
+++ b/app/controllers/projects/raw_controller.rb
@@ -12,6 +12,8 @@ class Projects::RawController < Projects::ApplicationController
 
     if @blob
       headers['X-Content-Type-Options'] = 'nosniff'
+      check_etag!
+      set_cache_headers
 
       if @blob.lfs_pointer?
         send_lfs_object
diff --git a/app/helpers/blob_helper.rb b/app/helpers/blob_helper.rb
index 7f63a2e2cb4..adb56e49c62 100644
--- a/app/helpers/blob_helper.rb
+++ b/app/helpers/blob_helper.rb
@@ -152,4 +152,29 @@ module BlobHelper
       'application/octet-stream'
     end
   end
+
+  def set_cache_headers
+    if @project.visibility_level == Project::PUBLIC
+      cache_control = 'public, '
+    else
+      cache_control = 'private, '
+    end
+
+    if @ref && @commit && @ref == @commit.id
+      # This is a link to a commit by its commit SHA. That means that the blob
+      # is immutable.
+      cache_control << 'max-age=600' # 10 minutes
+    else
+      # A branch or tag points at this blob. That means that the expected blob
+      # value may change over time.
+      cache_control << 'max-age=60' # 1 minute
+    end
+
+    headers['Cache-Control'] = cache_control
+    headers['ETag'] = @blob.id
+  end
+
+  def check_etag!
+    stale?(etag: @blob.id)
+  end
 end
diff --git a/app/models/project.rb b/app/models/project.rb
index 148eab692ff..aba48f87be3 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -56,6 +56,7 @@ class Project < ActiveRecord::Base
   extend Gitlab::ConfigHelper
 
   UNKNOWN_IMPORT_URL = 'http://unknown.git'
+  AVATAR_BRANCH = 'master'
 
   default_value_for :archived, false
   default_value_for :visibility_level, gitlab_config_features.visibility_level
@@ -544,9 +545,9 @@ class Project < ActiveRecord::Base
   end
 
   def avatar_in_git
-    @avatar_file ||= 'logo.png' if repository.blob_at_branch('master', 'logo.png')
-    @avatar_file ||= 'logo.jpg' if repository.blob_at_branch('master', 'logo.jpg')
-    @avatar_file ||= 'logo.gif' if repository.blob_at_branch('master', 'logo.gif')
+    @avatar_file ||= 'logo.png' if repository.blob_at_branch(AVATAR_BRANCH, 'logo.png')
+    @avatar_file ||= 'logo.jpg' if repository.blob_at_branch(AVATAR_BRANCH, 'logo.jpg')
+    @avatar_file ||= 'logo.gif' if repository.blob_at_branch(AVATAR_BRANCH, 'logo.gif')
     @avatar_file
   end
 
diff --git a/app/views/projects/blob/_image.html.haml b/app/views/projects/blob/_image.html.haml
index 3c11b97921f..18caddabd39 100644
--- a/app/views/projects/blob/_image.html.haml
+++ b/app/views/projects/blob/_image.html.haml
@@ -6,4 +6,4 @@
     - blob = sanitize_svg(blob)
     %img{src: "data:#{blob.mime_type};base64,#{Base64.encode64(blob.data)}"}
   - else
-    %img{src: namespace_project_raw_path(@project.namespace, @project, @id)}
+    %img{src: namespace_project_raw_path(@project.namespace, @project, tree_join(@commit.id, blob.path))}