diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index bfcd16b..f310e4b 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -123,6 +123,12 @@ http {
         listen 443 default_server ssl backlog=4096;
         listen [::]:443 default_server ssl backlog=4096;
         ssl_reject_handshake on;
+
+        # work around unreliable ssl_reject_handshake
+        keepalive_timeout 0;
+        location / {
+            return 404;
+        }
     }
 
     server {