diff --git a/api/router.ts b/api/router.ts
index ea9bfe8..14ca069 100644
--- a/api/router.ts
+++ b/api/router.ts
@@ -79,6 +79,18 @@ router_.all('/_web/*', async (ctx) => {
   for (const h of ['host', 'connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'authorization']) {
     headers.delete(h);
   }
+  // ACCEPT-ENCODING GOES TOO, and this one is not tidiness.
+  //
+  // `fetch()` transparently decompresses a response, but `upstream.headers` still says
+  // `content-encoding: gzip`. Re-emitting those headers with the decompressed body hands the browser a
+  // lie, and it fails with ZlibError — reported here as a 502, which is what every asset in the frame
+  // was doing while the HTML rendered fine. The HTML escaped only because the sidecar drops that header
+  // when it rewrites.
+  //
+  // Asking for no compression at all removes the mismatch instead of chasing it through two hops. The
+  // cost is nil: this hop is loopback, and the browser's own connection to the platform is compressed by
+  // whatever terminates TLS.
+  headers.delete('accept-encoding');
   // The sidecar binds loopback and trusts these, which is exactly why nothing but this may set them.
   headers.set('X-Officer-User', String(userId));
   // Where the browser thinks the frame lives. The sidecar rewrites Gitea's HTML, redirects and cookies