diff --git a/dev2/templates/nginx-vhost.conf b/dev2/templates/nginx-vhost.conf
index eef5994..68afa7e 100644
--- a/dev2/templates/nginx-vhost.conf
+++ b/dev2/templates/nginx-vhost.conf
@@ -41,5 +41,12 @@ server {
         proxy_set_header Connection $connection_upgrade;
         proxy_read_timeout 300s;
         proxy_buffering off;
+        # Response headers are read into proxy_buffer_size even with buffering
+        # off. Supabase SSR auth sets several chunked sb-*-auth-token cookies on
+        # login, which overflow the 4k/8k default: nginx logs "upstream sent too
+        # big header" and every successful sign-in becomes a 502.
+        proxy_buffer_size 64k;
+        proxy_buffers 8 64k;
+        proxy_busy_buffers_size 128k;
     }
 }