diff --git a/services/nginx.nix b/services/nginx.nix
index df9cd3e..70c4df3 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -103,16 +103,7 @@ in
       virtualHosts = {
         # --- Unprotected (own auth, or by design) ---
         "auth.nordhammer.it"     = proxy 9091;  # Authelia portal itself
-        # Streaming to external clients. The LG webOS app loads jellyfin-web in
-        # an iframe, so X-Frame-Options / frame-ancestors from securityHeaders
-        # blank the screen right after the server URL is entered.
-        "jellyfin.nordhammer.it" = lib.recursiveUpdate (proxy 8096) {
-          locations."/".extraConfig = ''
-            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-            add_header X-Content-Type-Options "nosniff" always;
-            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-          '';
-        };
+        "jellyfin.nordhammer.it" = proxy 8096;  # streaming to external clients
         "seerr.nordhammer.it"    = proxy 5055;  # own auth via Jellyfin sign-in
 
         # Watch-party relay (services/owncast.nix). Shared basic-auth password