diff --git a/bundles/nginx/files/nginx.conf b/bundles/nginx/files/nginx.conf
index ef45635..4c6253e 100644
--- a/bundles/nginx/files/nginx.conf
+++ b/bundles/nginx/files/nginx.conf
@@ -32,12 +32,13 @@ http {
 
     % endif
 
-    % if has_websockets:
+    # Always defined: serves both WS-enabled vhosts (Connection: upgrade for
+    # ws clients) and SSE/keep-alive vhosts (Connection: "" lets nginx manage
+    # the upstream connection for keep-alive, instead of forcing "close").
     map $http_upgrade $connection_upgrade {
         default upgrade;
-        '' close;
+        '' '';
     }
-    % endif
 
     include /etc/nginx/sites-enabled/*;
 }
diff --git a/data/nginx/proxy_pass.conf b/data/nginx/proxy_pass.conf
index d682396..b30c81f 100644
--- a/data/nginx/proxy_pass.conf
+++ b/data/nginx/proxy_pass.conf
@@ -8,10 +8,16 @@ server {
 
     location / {
         proxy_set_header   X-Real-IP          $remote_addr;
-% if websockets:
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-% endif
+        # Always set Upgrade + Connection via the $connection_upgrade map:
+        #   WS client (Upgrade header sent)  -> Connection: upgrade
+        #   non-WS client (no Upgrade)       -> Connection: "" (keep-alive)
+        # Lets every vhost serve both WS and SSE without per-vhost flags.
+        proxy_http_version 1.1;
+        proxy_set_header   Upgrade            $http_upgrade;
+        proxy_set_header   Connection         $connection_upgrade;
+        # SSE-safe pass-through (also fine for non-SSE traffic):
+        proxy_buffering    off;
+        proxy_read_timeout 1h;
         proxy_pass ${target};
     }
 }