diff --git a/asset/nginx/site.conf.tmpl b/asset/nginx/site.conf.tmpl
index 05594f0..a519e6d 100644
--- a/asset/nginx/site.conf.tmpl
+++ b/asset/nginx/site.conf.tmpl
@@ -18,6 +18,16 @@ server {
     root {{WEB_ROOT}};
     index index.html;
 
+    # Emit relative Location headers. `try_files $uri $uri/` 301s a slash-less
+    # directory URL (/activity -> /activity/), and by default nginx builds that
+    # redirect from its own $server_port — WEB_LISTEN's 14443, not the 443 the
+    # client used, because this vhost sits behind the edge's stream SNI router.
+    # So /activity redirected visitors to https://rob.tn:14443/activity/, where
+    # nothing answers from outside, and the browser hung until its connect
+    # timeout (60s+) before failing. Relative redirects keep whatever scheme,
+    # host and port the client actually used.
+    absolute_redirect off;
+
     # Compress text responses on the wire. text/html is always compressed when
     # gzip is on (nginx won't let it be listed in gzip_types); the prerendered
     # pages are large — the dashboard bakes the full all-time activity dataset —