diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile
index 71d6cd2..6a81ff0 100644
--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@@ -14,8 +14,15 @@ ENV VITE_API_BASE_URL=$VITE_API_BASE_URL
 RUN bun run --cwd packages/shared build
 RUN bun run --cwd apps/web build
 
-FROM nginx:1.27-alpine AS runner
-COPY apps/web/nginx.conf /etc/nginx/conf.d/default.conf
-COPY --from=builder /app/apps/web/dist /usr/share/nginx/html
+# =============================================================================
+# Stage 2: nginx (Alpine package — includes sub_filter module)
+# Alpine's nginx package is built with --with-http_sub_module
+# =============================================================================
+FROM alpine:3.20 AS runner
+RUN apk add --no-cache nginx
+
+COPY apps/web/nginx.conf /etc/nginx/http.d/default.conf
+COPY --from=builder /app/apps/web/dist /var/lib/nginx/html
+
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
diff --git a/apps/web/nginx.conf b/apps/web/nginx.conf
index 21e1872..c6f302a 100644
--- a/apps/web/nginx.conf
+++ b/apps/web/nginx.conf
@@ -1,7 +1,7 @@
 server {
   listen 80;
   server_name _;
-  root /usr/share/nginx/html;
+  root /var/lib/nginx/html;
   index index.html;
 
   location /api/ {
@@ -28,6 +28,8 @@ server {
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
     expires 1y;
     add_header Cache-Control "public, immutable";
   }
@@ -57,7 +59,7 @@ server {
     proxy_read_timeout 10s;
   }
 
-  # Telemetry SPA — proxy to orange, rewrite root-relative paths to prefix
+  # Telemetry SPA — proxy to orange VPS, rewrite root-relative paths to /telemetry/ prefix
   location /telemetry/ {
     proxy_pass http://100.96.248.86:8181/;
     proxy_http_version 1.1;
@@ -69,7 +71,7 @@ server {
     proxy_send_timeout 35s;
     proxy_read_timeout 35s;
 
-    # Rewrite root-relative paths in HTML/JS to /telemetry/ prefix
+    # Rewrite root-relative paths (<script src="/", href="/", fetch("/")) to /telemetry/ prefix
     sub_filter_types text/html application/javascript;
     sub_filter_once off;
     sub_filter 'src="/' 'src="/telemetry/';