diff --git a/modules/server/media/jellyfin.nix b/modules/server/media/jellyfin.nix
index 7d69fb84..cd8d6c51 100644
--- a/modules/server/media/jellyfin.nix
+++ b/modules/server/media/jellyfin.nix
@@ -18,7 +18,26 @@ in {
           forceSSL = true;
           sslCertificate = "/srv/secrets/certs/sako.box.pem";
           sslCertificateKey = "/srv/secrets/certs/sako.box-key.pem";
-          locations."/" = { proxyPass = "http://localhost:8096"; };
+          extraConfig = ''
+                    add_header X-Frame-Options "SAMEORIGIN";
+                    add_header X-Content-Type-Options "nosniff";
+            add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
+            add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
+
+          '';
+          locations = {
+            "/" = {
+              proxyPass = "http://localhost:8096";
+              extraConfig = ''
+                # Disable buffering when the nginx proxy gets very resource heavy upon streaming
+                proxy_buffering off;
+              '';
+            };
+            "/socket" = {
+              proxyPass = "http://localhost:8096";
+              proxyWebsockets = true;
+            };
+          };
         };
       };
     };