diff --git a/sim/cluster0/nginx/apps-port80.conf b/sim/cluster0/nginx/apps-port80.conf
index 066ee17..5344c14 100644
--- a/sim/cluster0/nginx/apps-port80.conf
+++ b/sim/cluster0/nginx/apps-port80.conf
@@ -7,13 +7,29 @@ map $http_upgrade $connection_upgrade {
 	''      close;
 }
 
+# FE terminates TLS; upstream to this vhost is plain HTTP. Prefer X-Forwarded-Proto,
+# else force https for known public hostnames so redirects/cookies stay secure.
+map $http_x_forwarded_proto $fe_scheme {
+	default $scheme;
+	https https;
+	http http;
+}
+map $http_host $public_scheme {
+	default $fe_scheme;
+	apps.f0xx.org https;
+	s.f0xx.org https;
+	notify.f0xx.org https;
+	acl0.f0xx.org https;
+	~^c[1-3]\.acl0\.f0xx\.org$ https;
+}
+
 server {
 	listen 80 default_server;
 	listen [::]:80 default_server;
 
 	# FE proxies https://apps.f0xx.org/ here as GET / — hub lives under /app/androidcast_project/
 	location = / {
-		return 301 https://$http_host/app/androidcast_project/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/;
 	}
 
 	# OTA v0 static tree — devices fetch https://apps.f0xx.org/v0/ota/channel/stable.json
@@ -35,7 +51,7 @@ server {
 	}
 
 	location = /app/androidcast_project {
-		return 301 /app/androidcast_project/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/;
 	}
 
 	location = /app/androidcast_project/index.php {
@@ -67,12 +83,12 @@ server {
 	}
 
 	location = /app/androidcast_project/graphs {
-		return 301 /app/androidcast_project/graphs/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/graphs/;
 	}
 
 	# --- /issues/ served from composed ac/* backend ---
 	location = /app/androidcast_project/issues {
-		return 301 /app/androidcast_project/issues/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/issues/;
 	}
 
 	location ^~ /app/androidcast_project/issues/assets/ {
@@ -99,11 +115,11 @@ server {
 
 	# Legacy /crashes/ → 301 to /issues/ (SPEC §7)
 	location = /app/androidcast_project/crashes {
-		return 301 /app/androidcast_project/issues/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/issues/;
 	}
 
 	location ^~ /app/androidcast_project/crashes/ {
-		rewrite ^/app/androidcast_project/crashes/?(.*)$ /app/androidcast_project/issues/$1 permanent;
+		rewrite ^/app/androidcast_project/crashes/?(.*)$ $public_scheme://$http_host/app/androidcast_project/issues/$1 permanent;
 	}
 
 	location ^~ /app/androidcast_project/crashes/assets/ {
@@ -111,7 +127,7 @@ server {
 	}
 
 	location = /app/androidcast_project/crashes/api/upload.php {
-		return 301 /app/androidcast_project/issues/api/upload.php;
+		return 301 $public_scheme://$http_host/app/androidcast_project/issues/api/upload.php;
 	}
 
 	location ^~ /app/androidcast_project/graphs/assets/ {
@@ -145,7 +161,7 @@ server {
 	}
 
 	location = /app/androidcast_project/build {
-		return 301 /app/androidcast_project/build/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/build/;
 	}
 
 	location ^~ /app/androidcast_project/build/assets/ {
@@ -174,12 +190,12 @@ server {
 	}
 
 	location @monitor_login_redirect {
-		return 302 /app/androidcast_project/login?redirect=$request_uri;
+		return 302 $public_scheme://$http_host/app/androidcast_project/login?redirect=$request_uri;
 	}
 
 	# ── Grafana at cast04:3000 ────────────────────────────────────────────────
 	location = /app/androidcast_project/monitor {
-		return 301 /app/androidcast_project/monitor/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/monitor/;
 	}
 	location /app/androidcast_project/monitor/ {
 		auth_request /app/androidcast_project/api/grafana-auth-check.php;
@@ -200,7 +216,7 @@ server {
 
 	# ── Alertmanager at cast04:9093 ───────────────────────────────────────────
 	location = /app/androidcast_project/alertmanager {
-		return 301 /app/androidcast_project/alertmanager/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/alertmanager/;
 	}
 	location /app/androidcast_project/alertmanager/ {
 		auth_request /app/androidcast_project/api/grafana-auth-check.php;
@@ -218,7 +234,7 @@ server {
 
 	# ── Broadcast admin dashboard (/app/androidcast_project/broadcast/) ───────
 	location = /app/androidcast_project/broadcast {
-		return 301 /app/androidcast_project/broadcast/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/broadcast/;
 	}
 	location /app/androidcast_project/broadcast/ {
 		auth_request /app/androidcast_project/api/grafana-auth-check.php;
@@ -235,7 +251,7 @@ server {
 
 	# --- Gitea web UI (lab browse; mirrors configured separately) ---
 	location = /app/androidcast_project/git {
-		return 301 /app/androidcast_project/git/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/git/;
 	}
 	location ^~ /app/androidcast_project/git/ {
 		proxy_pass http://127.0.0.1:3000/;
@@ -276,7 +292,7 @@ server {
 
 	# Catch-all SFU paths → PHP signaling front controller
 	location = /app/androidcast_project/sfu {
-		return 301 /app/androidcast_project/sfu/;
+		return 301 $public_scheme://$http_host/app/androidcast_project/sfu/;
 	}
 
 	location ^~ /app/androidcast_project/sfu/ {