diff --git a/root/defaults/default.conf b/root/defaults/default.conf
index bb37818..fc3d971 100644
--- a/root/defaults/default.conf
+++ b/root/defaults/default.conf
@@ -37,16 +37,24 @@ server {
         return 302 /login.html;
     }
 
+    # The frontend files carry no version in their URLs, so they are revalidated on every
+    # load ("expires epoch" sends Cache-Control: no-cache): unchanged files cost a 304, and
+    # an update takes effect at once. Without it browsers cached them by guesswork and
+    # Cloudflare for 4 hours, running the old JavaScript against the new server.
+    # ("expires" is not add_header, so the security headers above still apply.)
     location = /login.html {
         root /app/frontend;
+        expires epoch;
     }
 
     location /css/ {
         root /app/frontend;
+        expires epoch;
     }
 
     location /js/ {
         root /app/frontend;
+        expires epoch;
     }
 
     location / {
@@ -55,6 +63,7 @@ server {
         root /app/frontend;
         index index.html;
         try_files $uri /index.html;
+        expires epoch;
     }
 
     location /api/ {
@@ -84,6 +93,8 @@ server {
         auth_request /_auth_verify;
         error_page 401 = @login;
         alias /usr/share/selkies/web/;
+        # The Selkies client, patched by ConnectHub: same reason as the frontend above
+        expires epoch;
         index index.html;
         try_files $uri $uri/ =404;
     }