diff --git a/scripts/check_repository.py b/scripts/check_repository.py
index 131b6be..10edb82 100644
--- a/scripts/check_repository.py
+++ b/scripts/check_repository.py
@@ -157,6 +157,8 @@ def check_render() -> None:
     for marker in ("resource-qr-repository", "resource-qr-page"):
         if marker not in html:
             raise AssertionError(f"HTML nie zawiera komórki {marker!r}")
+    if html.count('target="_blank" rel="noopener noreferrer"') < 2:
+        raise AssertionError("oba kody QR HTML muszą otwierać bezpieczną nową kartę")
     if "PROJECT" not in html:
         raise AssertionError("HTML nie zawiera nowej tabliczki projektu")
     if "resource-qr-label" in html:
diff --git a/tools/render_card.py b/tools/render_card.py
index 1a809a0..6b7330c 100644
--- a/tools/render_card.py
+++ b/tools/render_card.py
@@ -3928,6 +3928,7 @@ def render_page_header_html(data: dict, page: int, total: int) -> str:
         if qr:
             return (
                 f'<a class="{classes}" href="{html_escape(target)}" '
+                'target="_blank" rel="noopener noreferrer" '
                 f'aria-label="{html_escape(label)}: otwórz {html_escape(target)}">'
                 f'{qr}</a>'
             )
@@ -4458,6 +4459,7 @@ def render_title_block_html(data: dict) -> str:
     qr = qr_svg(str(fields["url"])) if fields["show_qr"] else ""
     qr_cell = (
         f'<a class="title-qr-cell" href="{html_escape(str(fields["url"]))}" '
+        'target="_blank" rel="noopener noreferrer" '
         f'aria-label="Otwórz adres z kodu QR">{qr}</a>'
         if qr
         else '<div class="title-qr-cell title-qr-empty"><span>QR</span><strong>'