diff --git a/docker-compose.yml b/docker-compose.yml
index 5cac4aa..a5ca0bd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,7 +20,7 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        CACHEBUST: "14"
+        CACHEBUST: "15"
         VITE_USE_MOCK_DATA: "false"
         VITE_CONTENT_ORIGIN: ${FRONTEND_URL}
         VITE_INDEEHUB_API_URL: /api
diff --git a/nginx.conf b/nginx.conf
index 660ae09..e9ab563 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -45,6 +45,21 @@ server {
         add_header Content-Type application/manifest+json;
     }
 
+    # ── Service Worker — must be exact-match to avoid the immutable
+    # caching regex below. Browsers require fresh SW scripts.
+    location = /sw.js {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        expires off;
+        access_log off;
+    }
+
+    location ~* ^/workbox-.*\.js$ {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        expires off;
+        access_log off;
+    }
+
+    # Static assets — long-lived immutable cache
     location ~* \.(?:js|css|woff2|woff|ttf|otf|eot|svg|png|jpg|jpeg|gif|ico)$ {
         expires 1y;
         add_header Cache-Control "public, immutable";
@@ -130,23 +145,6 @@ server {
         try_files $uri $uri/ /index.html;
     }
 
-    # Service Worker
-    location /sw.js {
-        add_header Cache-Control "no-cache";
-        proxy_cache_bypass $http_pragma;
-        proxy_cache_revalidate on;
-        expires off;
-        access_log off;
-    }
-
-    location /workbox-*.js {
-        add_header Cache-Control "no-cache";
-        proxy_cache_bypass $http_pragma;
-        proxy_cache_revalidate on;
-        expires off;
-        access_log off;
-    }
-
     # Health check endpoint
     location /health {
         access_log off;