diff --git a/packages/web/infra/default.conf b/packages/web/infra/default.conf
index aff74785..475fbea0 100644
--- a/packages/web/infra/default.conf
+++ b/packages/web/infra/default.conf
@@ -1,42 +1,58 @@
 server {
-    listen       8080;
-    server_name  localhost;
-
-    root   /usr/share/nginx/html;
-    index  index.html index.htm;
-
-    location / {
-        try_files $uri $uri/ /index.html;
-    }
-
-    error_page 500 502 503 504 /50x.html;
-    location = /50x.html {
-        internal;
-    }
-
-    location ~ /\.ht {
-        deny all;
-    }
-
-    gzip on;
-    gzip_disable "msie6";
-
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_comp_level 6;
-    gzip_buffers 16 8k;
-    gzip_http_version 1.1;
-    gzip_types
-        text/plain
-        text/css
-        text/xml
-        text/javascript
-        application/javascript
-        application/x-javascript
-        application/json
-        application/xml
-        application/xml+rss
-        font/ttf
-        font/otf
-        image/svg+xml;
+  listen 8080;
+  server_name localhost;
+
+  root /usr/share/nginx/html;
+  index index.html;
+
+  # Serve static assets directly (hashed filenames get long cache)
+  location ~* \.(?:js|mjs|css|png|jpg|jpeg|gif|ico|webp|avif|svg|ttf|otf|woff|woff2|map)$ {
+    access_log off;
+    etag on;
+
+    # If you build with hashed filenames (e.g. app.abc123.js), cache hard:
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+    try_files $uri =404;
+  }
+
+  # Never cache index.html so deploys go live immediately
+  location = /index.html {
+    etag on;
+    add_header Cache-Control "no-cache";
+  }
+
+  # SPA fallback for client-side routes
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+
+  # Basic error page (optional)
+  error_page 500 502 503 504 /50x.html;
+  location = /50x.html { internal; }
+
+  # Security hardening
+  location ~ /\.ht { deny all; }
+
+  # Gzip (works fine with your asset types)
+  gzip on;
+  gzip_disable "msie6";
+  gzip_vary on;
+  gzip_proxied any;
+  gzip_comp_level 6;
+  gzip_buffers 16 8k;
+  gzip_http_version 1.1;
+  gzip_types
+    text/plain
+    text/css
+    text/xml
+    text/javascript
+    application/javascript
+    application/x-javascript
+    application/json
+    application/xml
+    application/xml+rss
+    font/ttf
+    font/otf
+    image/svg+xml;
 }
diff --git a/packages/web/package.json b/packages/web/package.json
index 88e4b6ed..c29040e1 100644
--- a/packages/web/package.json
+++ b/packages/web/package.json
@@ -22,6 +22,7 @@
 		"test": "vitest",
 		"ts:check": "bun run tsc --noEmit",
 		"preview": "vite preview",
+		"docker:build": "docker build -t meshtastic-web:latest -f ./infra/Containerfile .",
 		"generate:routes": "bun @tanstack/router-cli generate --outDir src/ routes --rootRoutePath /",
 		"package": "gzipper c -i html,js,css,png,ico,svg,json,webmanifest,txt dist dist/output && tar -cvf dist/build.tar -C ./dist/output/ ."
 	},