diff --git a/frontend/nginx.conf b/frontend/nginx.conf
index 938d8d0..082f5a3 100644
--- a/frontend/nginx.conf
+++ b/frontend/nginx.conf
@@ -1,3 +1,11 @@
+# Honor a reverse proxy's X-Forwarded-Proto (e.g. traefik terminating TLS) so the API sees
+# https and builds https OAuth redirects; fall back to the connection scheme for direct access.
+map $http_x_forwarded_proto $fwd_proto {
+    default $scheme;
+    https   https;
+    http    http;
+}
+
 server {
     listen 80;
     server_name _;
@@ -27,7 +35,7 @@ server {
         proxy_pass http://api:8080;
         proxy_set_header Host $http_host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $fwd_proto;
         proxy_set_header X-Forwarded-Host $http_host;
         proxy_set_header Cookie $http_cookie;
     }
@@ -38,7 +46,7 @@ server {
         proxy_pass http://api:8080;
         proxy_set_header Host $http_host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto $fwd_proto;
         proxy_set_header X-Forwarded-Host $http_host;
         proxy_set_header Cookie $http_cookie;
     }