diff --git a/docker/nginx.conf b/docker/nginx.conf
index bac6c3a7..09726610 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -43,11 +43,28 @@ server {
     try_files $uri =404;
   }
 
-  # SPA fallback — every unknown path returns index.html
+  # Service worker MUST never be cached so we can ship SW updates.
+  # Safari/iOS especially clings to old sw.js otherwise.
+  location = /sw.js {
+    root /usr/share/nginx/html;
+    add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0";
+    add_header Pragma "no-cache";
+    add_header Expires "0";
+    try_files $uri =404;
+  }
+
+  # SPA fallback — every unknown path returns index.html.
+  # `no-cache` alone is unreliable on iOS Safari (sometimes the browser
+  # serves a stale copy after a deploy). Pair it with `no-store` + the
+  # legacy `Pragma`/`Expires` headers so every device — phones, iPads,
+  # laptops — re-fetches index.html and picks up the freshly-hashed
+  # assets/*.js bundle on every navigation.
   location / {
     root /usr/share/nginx/html;
     index index.html;
     try_files $uri $uri/ /index.html;
-    add_header Cache-Control "no-cache";
+    add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0";
+    add_header Pragma "no-cache";
+    add_header Expires "0";
   }
 }