diff --git a/Dockerfile b/Dockerfile
index 0477d1b..81fd16c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,17 +1,40 @@
-FROM node:lts AS build
+FROM node:22-bookworm AS build
 WORKDIR /app
 COPY . .
 RUN corepack enable && \
     pnpm install --frozen-lockfile && \
     pnpm run build
 
-FROM node:lts AS runtime
+FROM node:22-bookworm AS runtime
 WORKDIR /app
 
+ENV NGINX_VERSION   1.27.0
+ENV NJS_VERSION     0.8.4
+ENV NJS_RELEASE     2~bookworm
+ENV PKG_RELEASE     2~bookworm
+RUN apt-key adv --keyserver "hkp://keyserver.ubuntu.com:80" --keyserver-options timeout=10 --recv-keys 573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 && \
+    echo "deb https://nginx.org/packages/mainline/debian/ bookworm nginx" >> /etc/apt/sources.list.d/nginx.list  && \
+    apt-get update && \
+    apt-get install --no-install-recommends --no-install-suggests -y \
+      nginx=${NGINX_VERSION}-${PKG_RELEASE} \
+      nginx-module-xslt=${NGINX_VERSION}-${PKG_RELEASE} \
+      nginx-module-geoip=${NGINX_VERSION}-${PKG_RELEASE} \
+      nginx-module-image-filter=${NGINX_VERSION}-${PKG_RELEASE} \
+      nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${PKG_RELEASE} \
+      gettext-base \
+      curl && \
+    apt-get remove --purge --auto-remove -y && rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx.list && \
+    ln -sf /dev/stdout /var/log/nginx/access.log && \
+    ln -sf /dev/stderr /var/log/nginx/error.log
+
+# nodejs app host and port
+ENV HOST=0.0.0.0
+ENV PORT=4321
+EXPOSE 80
+CMD /run.sh
+
+ADD run.sh /run.sh
+ADD nginx.conf /etc/nginx/conf.d/default.conf
+
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist
-
-ENV HOST=0.0.0.0
-ENV PORT=4321
-EXPOSE 4321
-CMD node ./dist/server/entry.mjs
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..a5b335a
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,57 @@
+# Expires map
+map $sent_http_content_type $expires {
+    default                    off;
+    text/html                  epoch; # We don't cache the html for the browser to get the content
+    text/css                   max;
+    application/javascript     max;
+    ~image/                    max;
+    ~font/                     max;
+}
+
+server {
+    listen 80;
+
+    server_name _;
+
+    expires $expires;
+
+    gzip  on;
+    gzip_disable "msie6";
+
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_min_length 256;
+    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript application/vnd.ms-fontobject application/x-font-ttf font/opentype image/svg+xml font/woff2 image/x-icon;
+
+    charset utf-8;
+
+    location / {
+        root   /app/dist/client/;
+        try_files $uri $uri/index.html @nodejs;
+    }
+
+    location /survey {
+        return 302 https://forms.reform.app/oSTwrh/vikunja-feedback;
+    }
+
+    error_page 404 /404.html;
+    error_page 500 502 503 504  /50x.html;
+    location = /50x.html {
+        root   /usr/share/nginx/html;
+    }
+
+    location @nodejs {
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header Scheme $scheme;
+        proxy_set_header SERVER_PORT $server_port;
+        proxy_set_header REMOTE_ADDR $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Upgrade $http_upgrade;
+
+        proxy_pass http://127.0.0.1:4321;
+    }
+}
diff --git a/run.sh b/run.sh
new file mode 100755
index 0000000..78803d7
--- /dev/null
+++ b/run.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -e
+
+node /app/dist/server/entry.mjs &
+
+exec nginx -g 'daemon off;'