diff --git a/frontend/nginx.conf b/frontend/nginx.conf
index ef1a289..b73af29 100644
--- a/frontend/nginx.conf
+++ b/frontend/nginx.conf
@@ -4,6 +4,20 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # index.html must never be cached — it references hashed asset filenames
+    # that change on every build. Stale HTML → wrong JS bundle → broken app.
+    location = /index.html {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header Pragma "no-cache";
+    }
+
+    # Hashed JS/CSS/image assets are safe to cache forever — the filename
+    # changes whenever the content changes, so there's no stale-file risk.
+    location ~* \.(?:js|css|woff2?|svg|png|jpg|ico)$ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+        try_files $uri =404;
+    }
+
     location / {
         try_files $uri $uri/ /index.html;
     }