diff --git a/deploy/nginx/pascal-service.conf.template b/deploy/nginx/pascal-service.conf.template
index aad0147e5..2eef778be 100644
--- a/deploy/nginx/pascal-service.conf.template
+++ b/deploy/nginx/pascal-service.conf.template
@@ -17,6 +17,42 @@ location = __PASCAL_BASE_PATH__ {
     return 302 __PASCAL_BASE_PATH__/scenes;
 }
 
+# Versioned application chunks and bundled public assets contain no user data.
+# Serving them without an auth subrequest prevents an expired/rotating session
+# from turning a harmless static request into an Nginx 500 response.
+location ^~ __PASCAL_BASE_PATH__/_next/static/ {
+    proxy_pass http://__PASCAL_NGINX_UPSTREAM__;
+    proxy_http_version 1.1;
+    proxy_hide_header X-Powered-By;
+    proxy_set_header Host $host;
+    proxy_set_header Connection "";
+    proxy_buffering on;
+    expires 7d;
+    add_header Cache-Control "public, max-age=604800, immutable" always;
+}
+
+location ^~ __PASCAL_BASE_PATH__/icons/ {
+    proxy_pass http://__PASCAL_NGINX_UPSTREAM__;
+    proxy_http_version 1.1;
+    proxy_hide_header X-Powered-By;
+    proxy_set_header Host $host;
+    proxy_set_header Connection "";
+    proxy_buffering on;
+    expires 7d;
+    add_header Cache-Control "public, max-age=604800" always;
+}
+
+location ^~ __PASCAL_BASE_PATH__/audios/ {
+    proxy_pass http://__PASCAL_NGINX_UPSTREAM__;
+    proxy_http_version 1.1;
+    proxy_hide_header X-Powered-By;
+    proxy_set_header Host $host;
+    proxy_set_header Connection "";
+    proxy_buffering on;
+    expires 7d;
+    add_header Cache-Control "public, max-age=604800" always;
+}
+
 location ^~ __PASCAL_BASE_PATH__/ {
     auth_request /_pascal_auth;
     auth_request_set $pascal_user_id $upstream_http_x_pascal_user_id;