diff --git a/webapp.nix b/webapp.nix
index 20495fd..5c8d820 100644
--- a/webapp.nix
+++ b/webapp.nix
@@ -319,11 +319,20 @@ in {
 
         locations = {
           "/" = {
-            # Try files, fallback to index.html for SPA routing
+            # Try files, fallback to index.html for SPA routing.
+            # Everything matching this prefix ultimately serves the SPA
+            # shell (index.html), which must revalidate on every load so
+            # new deploys are picked up without the browser holding a
+            # stale shell pointing at deleted hashed assets. The more-
+            # specific regex location below overrides this for hashed
+            # static assets, which stay immutable.
             tryFiles = "$uri $uri/ /index.html";
+            extraConfig = ''
+              add_header Cache-Control "no-cache";
+            '';
           };
 
-          # Cache static assets aggressively
+          # Cache static assets aggressively (Vite emits content-hashed filenames)
           "~* \\.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$" = {
             extraConfig = ''
               expires 1y;