diff --git a/fly/nginx.conf b/fly/nginx.conf
index 9af2509..db02a21 100644
--- a/fly/nginx.conf
+++ b/fly/nginx.conf
@@ -52,6 +52,14 @@ http {
     resolver 100.100.100.100 valid=30s;
     resolver_timeout 5s;
 
+    # WebSocket-aware Connection header. Only send "upgrade" when the client
+    # actually requests a protocol switch; otherwise "close" (the HTTP/1.1
+    # default when keepalive pooling is not available).
+    map $http_upgrade $connection_upgrade {
+        default close;
+        websocket upgrade;
+    }
+
     # --- docs.eblu.me (static site) ---
     server {
         listen 8080;
@@ -192,7 +200,7 @@ http {
 
             proxy_http_version 1.1;
             proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
+            proxy_set_header Connection $connection_upgrade;
         }
 
         # Cache release artifact downloads — immutable files keyed by tag+filename.
@@ -248,7 +256,7 @@ http {
             # WebSocket support (Forgejo uses it for live updates)
             proxy_http_version 1.1;
             proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
+            proxy_set_header Connection $connection_upgrade;
 
             add_header X-Clacks-Overhead "GNU Terry Pratchett" always;
         }