diff --git a/services/nginx.nix b/services/nginx.nix
index 70c4df3..df9cd3e 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -103,7 +103,16 @@ in
       virtualHosts = {
         # --- Unprotected (own auth, or by design) ---
         "auth.nordhammer.it"     = proxy 9091;  # Authelia portal itself
-        "jellyfin.nordhammer.it" = proxy 8096;  # streaming to external clients
+        # Streaming to external clients. The LG webOS app loads jellyfin-web in
+        # an iframe, so X-Frame-Options / frame-ancestors from securityHeaders
+        # blank the screen right after the server URL is entered.
+        "jellyfin.nordhammer.it" = lib.recursiveUpdate (proxy 8096) {
+          locations."/".extraConfig = ''
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+          '';
+        };
         "seerr.nordhammer.it"    = proxy 5055;  # own auth via Jellyfin sign-in
 
         # Watch-party relay (services/owncast.nix). Shared basic-auth password