diff --git a/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf b/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
index 263f5d672..1f0bb7eb5 100644
--- a/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
+++ b/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
@@ -68,23 +68,6 @@ http {
         set $session_secret Eeko7aeb6iu5Wohch9Loo1aitha0ahd1;
         set $session_storage cookie;
 
-        # Static content to serve
-        root  /var/www/html;
-        index index.html index.htm;
-
-        # Single Page App
-        # Try files, fallback to index.html
-        #
-        location / {
-          try_files $uri $uri/ /index.html;
-        }
-
-        # DO NOT CACHE
-        # This is where we would pick up on a new version/service-worker
-        #
-        location /index.html {
-          add_header Cache-Control no-cache;
-        }
         server_tokens off; # Hides server version num
 
         # [PROTECTED] Reverse Proxy for `orthanc`
@@ -149,6 +132,26 @@ http {
           proxy_pass http://keycloak:8080/auth/;
         }
 
+        # Do not cache sw.js, required for offline-first updates.
+        location /sw.js {
+          add_header Cache-Control "no-cache";
+          proxy_cache_bypass $http_pragma;
+          proxy_cache_revalidate on;
+          expires off;
+          access_log off;
+        }
+
+        # Single Page App
+        # Try files, fallback to index.html
+        #
+        location / {
+          alias  /var/www/html/;
+          index index.html;
+          try_files $uri $uri/ /index.html;
+          # Don't cache index.html
+          # This is where we pickup on a new release
+          add_header Cache-Control "no-store, no-cache, must-revalidate";
+        }
 
         # EXAMPLE: Reverse Proxy, no auth
         # [UNPROTECTED] reverse proxy for `orthanc`