diff --git a/deploy/vm/nginx/conf.d/rolac.conf b/deploy/vm/nginx/conf.d/rolac.conf
index 15fe986..ede2c4c 100644
--- a/deploy/vm/nginx/conf.d/rolac.conf
+++ b/deploy/vm/nginx/conf.d/rolac.conf
@@ -22,6 +22,25 @@ server {
     proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header   X-Forwarded-Proto $scheme;
   }
+  
+  # SignalR hubs -> api container. Must be proxied to Kestrel like /api/; without
+  # this block /hubs/* fell through to "location /" (the static app), whose nginx
+  # 405s the negotiate POST so the connection never reaches the backend. The
+  # Upgrade/Connection headers + http_version 1.1 let the WebSocket transport
+  # establish instead of degrading to long-polling.
+  location /hubs/ {
+    set $upstream_api api;
+    proxy_pass         http://$upstream_api:8080$request_uri;
+    proxy_http_version 1.1;
+    proxy_set_header   Upgrade $http_upgrade;
+    proxy_set_header   Connection $connection_upgrade;
+    proxy_set_header   Host $host;
+    proxy_set_header   X-Real-IP $remote_addr;
+    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header   X-Forwarded-Proto $scheme;
+    proxy_buffering    off;
+    proxy_read_timeout 100s;
+  }
 
   # Everything else -> the Angular static app (its own nginx does SPA fallback).
   location / {