diff --git a/web/nginx.conf b/web/nginx.conf
index 019bc3f..0ceaf52 100644
--- a/web/nginx.conf
+++ b/web/nginx.conf
@@ -4,15 +4,13 @@ server {
     index index.html;
 
     # SPA fallback — serve index.html for all routes that don't match a file.
+    # no-cache ensures the browser revalidates on every visit so users never
+    # see stale HTML after OAuth redirects or deploys.
     location / {
+        add_header Cache-Control "no-cache" always;
         try_files $uri $uri/ /index.html;
     }
 
-    # index.html must always be revalidated so browsers pick up new bundles.
-    location = /index.html {
-        add_header Cache-Control "no-cache";
-    }
-
     # Hashed assets from Vite never change — cache them aggressively.
     location /assets/ {
         add_header Cache-Control "public, max-age=31536000, immutable";
diff --git a/web/src/main.tsx b/web/src/main.tsx
index 8bd2a3a..4dcb245 100644
--- a/web/src/main.tsx
+++ b/web/src/main.tsx
@@ -5,6 +5,10 @@ import { router } from "./router/routes";
 import { BreadcrumbProvider } from "./hooks/useBreadcrumb";
 import "./index.css";
 
+window.addEventListener("pageshow", (event) => {
+  if (event.persisted) window.location.reload();
+});
+
 createRoot(document.getElementById("root")!).render(
   <StrictMode>
     <BreadcrumbProvider>