diff --git a/services/nginx.nix b/services/nginx.nix
index 70c4df3..ea200aa 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -37,11 +37,11 @@ let
   # so any location below that sets add_header must re-include this string.
   securityHeaders = ''
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Frame-Options $frame_options always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
-    add_header Content-Security-Policy "default-src 'self' https: wss: data: blob: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self';" always;
+    add_header Content-Security-Policy "default-src 'self' https: wss: data: blob: 'unsafe-inline' 'unsafe-eval';$frame_ancestors" always;
   '';
 
   # Simple reverse proxy vhost
@@ -98,6 +98,18 @@ in
       appendHttpConfig = ''
         proxy_headers_hash_max_size 1024;
         access_log /var/log/nginx/access.log;
+
+        # The LG webOS Jellyfin app loads jellyfin-web in an iframe; frame
+        # restrictions blank its screen right after the server URL is entered.
+        # Empty value = add_header skips it (a per-location override trips gixy).
+        map $host $frame_options {
+          jellyfin.nordhammer.it "";
+          default "SAMEORIGIN";
+        }
+        map $host $frame_ancestors {
+          jellyfin.nordhammer.it "";
+          default " frame-ancestors 'self';";
+        }
       '' + securityHeaders;
 
       virtualHosts = {