diff --git a/README.md b/README.md
index 294c6f7..7cb5603 100644
--- a/README.md
+++ b/README.md
@@ -51,6 +51,38 @@ curl -X POST -H "X-Revalidate-Secret: $SECRET" https://<frontend>/api/revalidate
 
 Note: ISR is off under `npm run dev`; use `npm run build && npm run start` to test caching.
 
+## Production proxy (Caddy)
+
+Both apps run on Coolify on `ds.neuf.no` behind the `coolify-proxy` container
+(caddy-docker-proxy). Extra config lives in `/data/coolify/proxy/caddy/dynamic/` on the host,
+not in any repo:
+
+- `Caddyfile`, `default_redirect_503.caddy`: Coolify's own.
+- `studentfestivalen-redirects.caddy`: `studentfestivalen.no` and `studioweb.no` → `neuf.no/studio`.
+- `cms-neuf-no.subdirectives`:
+
+  ```caddy
+  rewrite / /admin/
+
+  handle_path /media/* {
+  	root * /site/cms.neuf.no/media
+  	file_server
+  }
+  ```
+
+- `neuf-no.subdirectives`. The header replaces Next's `stale-while-revalidate`, which made
+  browsers reuse pages from old builds and broke navigation after deploys:
+
+  ```caddy
+  handle_path /media/* {
+          root * /site/cms.neuf.no/media
+          file_server
+  }
+
+  @pages not path /_next/static/* /_next/image* /assets/* /media/*
+  header @pages >Cache-Control "public, max-age=0, must-revalidate"
+  ```
+
 ## CMS login via Galtinn
 
 Editors log in to the CMS with their Galtinn account over OIDC (see `dnscms/dnscms/oidc.py`).