diff --git a/api/static-site.ts b/api/static-site.ts
index 91885d4..a82df2a 100644
--- a/api/static-site.ts
+++ b/api/static-site.ts
@@ -218,6 +218,14 @@ const NGINX_CONF = `server {
   root /usr/share/nginx/html;
   index index.html;
 
+  # Redirects stay relative, so they keep the scheme and host the visitor arrived on.
+  #
+  # nginx sits behind the proxy that terminates TLS, so it believes it is serving plain HTTP. Asked for
+  # /home/gallery/16 it correctly redirects to the directory — and wrote the Location as
+  # http://host/home/gallery/16/, downgrading an HTTPS visitor to HTTP for a round trip before the
+  # proxy sent them back. Off emits just the path, and the browser keeps the scheme it had.
+  absolute_redirect off;
+
   # Text compresses; the images and video here are already compressed formats and would only burn CPU.
   gzip on;
   gzip_vary on;