diff --git a/deploy/conf.d/default.conf b/deploy/conf.d/default.conf
index 8d24970..91d01dd 100644
--- a/deploy/conf.d/default.conf
+++ b/deploy/conf.d/default.conf
@@ -13,14 +13,15 @@ server {
     location ^~ /deploy/   { deny all; return 404; }
     location = /deploy-pull.sh { deny all; return 404; }
 
-    location = / {
-        try_files /facere.html =404;
-    }
-
     # The HTML entrypoint must NOT cache long — it carries the
     # ?v=… cache-busting tags that everything else relies on.
+    location = / {
+        add_header Cache-Control "public, max-age=0, must-revalidate" always;
+        expires off;
+        try_files /facere.html =404;
+    }
     location = /facere.html {
-        add_header Cache-Control "public, max-age=0, must-revalidate";
+        add_header Cache-Control "public, max-age=0, must-revalidate" always;
         expires off;
     }