diff --git a/api/static-site.ts b/api/static-site.ts
index 55403d9..b8b09fa 100644
--- a/api/static-site.ts
+++ b/api/static-site.ts
@@ -245,13 +245,15 @@ const NGINX_CONF = `server {
     add_header Cache-Control "public, immutable";
   }
 
-  # Everything a build produces. Seven days and no more: these names are stable across builds and the
-  # HTML that references them is revalidated every time, so a longer life means a visitor running last
-  # week's stylesheet against this week's markup. Fingerprinted filenames are what would earn a year
-  # here, and the build does not write them.
+  # Everything a build produces. A year, and immutable — earned, not assumed: every asset the layout
+  # links carries `?v=<build id>`, so a build that changes a file changes its URL, and the HTML that
+  # carries the new URLs is `no-cache` and revalidated on every visit. The two cannot disagree.
+  #
+  # This was seven days for as long as the URLs were bare, which was correct then: a stable name with a
+  # long life means somebody running last week's script against this week's markup.
   location ~* \\.(css|js|webp|png|jpg|jpeg|gif|svg|ico|mp4)$ {
-    expires 7d;
-    add_header Cache-Control "public";
+    expires 1y;
+    add_header Cache-Control "public, immutable";
   }
 
   location / {