diff --git a/CHANGES b/CHANGES
index 9bc2bdba6..fdaa557ce 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2082,4 +2082,5 @@
 * Fix bug where systemd 237 ignores --nice value in systemd-run
 * postgresql: enable uuid-ossp extension
 * firewall: add blocklist
+* HTTP URLs now redirect directly to the HTTPS of the final domain
 
diff --git a/src/nginxconfig.ejs b/src/nginxconfig.ejs
index dbe33fc55..fa8c2ace5 100644
--- a/src/nginxconfig.ejs
+++ b/src/nginxconfig.ejs
@@ -35,7 +35,14 @@ server {
 
     location / {
         # redirect everything to HTTPS
+<% if ( endpoint === 'admin' ) { %>
         return 301 https://$host$request_uri;
+<% } else if ( endpoint === 'app' ) { %>
+        return 301 https://$host$request_uri;
+<% } else if ( endpoint === 'redirect' ) { %>
+        return 301 https://<%= redirectTo %>$request_uri;
+<% } %>
+
     }
 }