There is probably a built in / default interceptor that has a :leave clause that executes after yours. Try adding an interceptor with a :leave as the very first interceptor.

e.g.,:

(update ::http/interceptors
              (fn [xs s] (into [s] xs))
              (interceptor/interceptor
                {:name :fix-xframe
                 :leave (fn [ctx]
                          ;...
                          )}))

Right I’ve done that. If I leave the X-FRAME-OPTIONS header undefined it just gets set to deny

If I set it to SAMEORIGIN, it stays as SAMEORIGIN

Hmm, maybe it is coming from Jetty (or your webserver)