diff --git a/frontend/nginx.conf b/frontend/nginx.conf
index f3bf2e13..8080e090 100644
--- a/frontend/nginx.conf
+++ b/frontend/nginx.conf
@@ -122,6 +122,24 @@ server {
         proxy_cache_valid 404 1m;
     }
 
+    # Self-hosted webfonts proxy (bundled families + admin user additions).
+    # ^~ modifier stops regex matching, ensuring fonts are proxied to the
+    # backend (which scans backend/assets/fonts and STORAGE_PATH/fonts) and
+    # NOT served locally — the .woff2 files do not exist in the frontend image.
+    location ^~ /fonts {
+        set $backend_upstream backend;
+        proxy_pass http://$backend_upstream:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Fonts rarely change; cache aggressively (matches backend Cache-Control).
+        proxy_cache_valid 200 302 7d;
+        proxy_cache_valid 404 1m;
+    }
+
     # Dynamic robots.txt served by backend
     location = /robots.txt {
         set $backend_upstream backend;