diff --git a/nginx.conf.template b/nginx.conf.template
index ab62a02..af89c8b 100644
--- a/nginx.conf.template
+++ b/nginx.conf.template
@@ -1,7 +1,6 @@
 server {
     listen 80;
     server_name _;
-    root /usr/share/nginx/html;
     index index.html;
 
     # Backend upstream (unified container: localhost:8080)
@@ -14,15 +13,6 @@ server {
     gzip_proxied expired no-cache no-store private auth;
     gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml application/javascript;
 
-    # Static assets — images/fonts get long cache; JS/CSS use revalidation
-    location ~* \.(jpg|jpeg|png|gif|ico|woff|woff2)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-    }
-    location ~* \.(css|js)$ {
-        add_header Cache-Control "no-cache, must-revalidate";
-    }
-
     # ── API + WebSocket → backend ────────────
     location ^~ ${BASE_PATH}/api/ {
         proxy_pass $backend;
@@ -37,6 +27,10 @@ server {
         proxy_pass $backend;
     }
 
+    location ^~ ${BASE_PATH}/healthz/ {
+        proxy_pass $backend;
+    }
+
     location = ${BASE_PATH}/metrics {
         proxy_pass $backend;
     }
@@ -89,10 +83,20 @@ server {
         add_header Cache-Control "no-cache";
     }
 
-    # Fallback: serve frontend shell (SPA)
-    # alias strips the BASE_PATH prefix so /test/css/app.css → /usr/share/nginx/html/css/app.css
+    # ── Static assets (fallback) ──────────────
+    # alias strips BASE_PATH so /test/css/app.css → /usr/share/nginx/html/css/app.css
+    # Cache headers applied via nested locations inside the alias block
     location ${BASE_PATH}/ {
         alias /usr/share/nginx/html/;
+
+        location ~* \.(jpg|jpeg|png|gif|ico|svg|woff|woff2)$ {
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+        }
+        location ~* \.(css|js)$ {
+            add_header Cache-Control "no-cache, must-revalidate";
+        }
+
         try_files $uri $uri/ /index.html;
     }