diff --git a/deploy/nginx-hicad-zoo-ws.conf.template b/deploy/nginx-hicad-zoo-ws.conf.template
index 0b4147cb5..3106772db 100644
--- a/deploy/nginx-hicad-zoo-ws.conf.template
+++ b/deploy/nginx-hicad-zoo-ws.conf.template
@@ -37,7 +37,12 @@ location ^~ /api/ai-cad/zoo-ws/ {
     auth_request /_hicad_zoo_ws_auth;
     auth_request_set $zoo_authorization $upstream_http_x_zoo_authorization;
 
-    proxy_pass https://api.zoo.dev/ws/;
+    # Resolve at request time and skip AAAA records because the production host
+    # has no IPv6 route. This avoids a long failed IPv6 retry on cold connects.
+    resolver 1.1.1.1 8.8.8.8 ipv6=off valid=300s;
+    set $zoo_api_host api.zoo.dev;
+    rewrite ^/api/ai-cad/zoo-ws/(.*)$ /ws/$1 break;
+    proxy_pass https://$zoo_api_host$uri$is_args$args;
     proxy_http_version 1.1;
     proxy_ssl_server_name on;
     proxy_ssl_name api.zoo.dev;