diff --git a/nginx/conf.d/default.conf b/nginx/conf.d/default.conf
index 16838af..86ac7fd 100644
--- a/nginx/conf.d/default.conf
+++ b/nginx/conf.d/default.conf
@@ -8,6 +8,14 @@ limit_req_zone $binary_remote_addr zone=global_rate_limit:10m rate=50r/s;
 # restarted. `valid=10s` bounds the stale window to ~10 seconds.
 resolver 127.0.0.11 valid=10s ipv6=off;
 
+# Preserve a trusted outer proxy's HTTPS scheme without reflecting arbitrary
+# client-supplied values into invoice and checkout URLs.
+map $http_x_forwarded_proto $origin_scheme {
+  default $scheme;
+  http http;
+  https https;
+}
+
 server {
   listen 80;
   server_name xmrcheckout.such.software localhost;
@@ -25,7 +33,7 @@ server {
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Proto $origin_scheme;
   }
 
   location /api {
@@ -38,7 +46,7 @@ server {
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Proto $origin_scheme;
   }
 
   location /qr/ {
@@ -53,6 +61,6 @@ server {
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Proto $origin_scheme;
   }
 }