diff --git a/apps/templates/nextcloud-helm.yaml b/apps/templates/nextcloud-helm.yaml
index f3fd67a..20ed248 100644
--- a/apps/templates/nextcloud-helm.yaml
+++ b/apps/templates/nextcloud-helm.yaml
@@ -53,30 +53,31 @@ spec:
           #  kubernetes.io/tls-acme: "true"
             cert-manager.io/cluster-issuer: prod-cluster-issuer
           #  # Keep this in sync with the README.md:
-          #  nginx.ingress.kubernetes.io/server-snippet: |-
-          #    server_tokens off;
-          #    proxy_hide_header X-Powered-By;
-          #    rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
-          #    rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
-          #    rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-          #    rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
-          #    location = /.well-known/carddav {
-          #      return 301 $scheme://$host/remote.php/dav;
-          #    }
-          #    location = /.well-known/caldav {
-          #      return 301 $scheme://$host/remote.php/dav;
-          #    }
-          #    location = /robots.txt {
-          #      allow all;
-          #      log_not_found off;
-          #      access_log off;
-          #    }
-          #    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
-          #      deny all;
-          #    }
-          #    location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
-          #      deny all;
-          #    }
+           nginx.ingress.kubernetes.io/server-snippet: |-
+             server_tokens off;
+             add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
+             proxy_hide_header X-Powered-By;
+             rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
+             rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
+             rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+             rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
+             location = /.well-known/carddav {
+               return 301 $scheme://$host/remote.php/dav;
+             }
+             location = /.well-known/caldav {
+               return 301 $scheme://$host/remote.php/dav;
+             }
+             location = /robots.txt {
+               allow all;
+               log_not_found off;
+               access_log off;
+             }
+             location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+               deny all;
+             }
+             location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
+               deny all;
+             }
           tls:
             - secretName: nextcloud-tls
               hosts: