diff --git a/docker/nginx/templates/default.conf.template b/docker/nginx/templates/default.conf.template
index d1c0b5b..b6c121a 100644
--- a/docker/nginx/templates/default.conf.template
+++ b/docker/nginx/templates/default.conf.template
@@ -37,7 +37,14 @@ server {
     server_name ${PUBLIC_HOST};
 
     # Inherited by every `location` below.
-    proxy_set_header Host              $host;
+    #
+    # ⚠️ `$http_host`, NOT `$host`: `$host` DROPS the port. Next.js Server
+    # Actions compare the forwarded host against the browser's `Origin`, which
+    # DOES carry a non-default port — with `$host` they mismatch and Next aborts
+    # every action with "Invalid Server Actions request" (a 500). `$http_host`
+    # preserves the port, so `Host`/`Origin` agree.
+    proxy_set_header Host              $http_host;
+    proxy_set_header X-Forwarded-Host  $http_host;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
     # better-auth checks the browser's Origin against WEB_URL; forward it as-is.