diff --git a/CHANGES b/CHANGES
index 444054acb..4ad2a9640 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2453,4 +2453,5 @@
 * mail: hide log button for non-superadmins
 * firewall: do not add duplicate ldap redirect rules
 * ldap: respond to RootDSE
+* nginx: update to 1.20.0-1
 
diff --git a/baseimage/initializeBaseUbuntuImage.sh b/baseimage/initializeBaseUbuntuImage.sh
index 7490dc980..f9532707e 100755
--- a/baseimage/initializeBaseUbuntuImage.sh
+++ b/baseimage/initializeBaseUbuntuImage.sh
@@ -63,7 +63,7 @@ apt-get -y install --no-install-recommends \
     xfsprogs
 
 echo "==> installing nginx for xenial for TLSv3 support"
-curl -sL http://nginx.org/packages/ubuntu/pool/nginx/n/nginx/nginx_1.18.0-2~${ubuntu_codename}_amd64.deb -o /tmp/nginx.deb
+curl -sL http://nginx.org/packages/ubuntu/pool/nginx/n/nginx/nginx_1.20.0-1~${ubuntu_codename}_amd64.deb -o /tmp/nginx.deb
 # apt install with install deps (as opposed to dpkg -i)
 apt install -y /tmp/nginx.deb
 rm /tmp/nginx.deb
diff --git a/scripts/installer.sh b/scripts/installer.sh
index cbe87f1fd..a78f514d9 100755
--- a/scripts/installer.sh
+++ b/scripts/installer.sh
@@ -87,9 +87,9 @@ if [[ $(docker version --format {{.Client.Version}}) != "${docker_version}" ]];
 fi
 
 readonly nginx_version=$(nginx -v 2>&1)
-if [[ "${nginx_version}" != *"1.18."* ]]; then
-    log "installing nginx 1.18"
-    $curl -sL http://nginx.org/packages/ubuntu/pool/nginx/n/nginx/nginx_1.18.0-2~${ubuntu_codename}_amd64.deb -o /tmp/nginx.deb
+if [[ "${nginx_version}" != *"1.20."* ]]; then
+    log "installing nginx 1.20"
+    $curl -sL http://nginx.org/packages/ubuntu/pool/nginx/n/nginx/nginx_1.20.0-1~${ubuntu_codename}_amd64.deb -o /tmp/nginx.deb
 
     prepare_apt_once