diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index ba4733e..ddc90b2 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -104,7 +104,10 @@ http {
         }
 
         location ~ ^(/_matrix|/_synapse/client) {
+            # remove security headers that are statically set to the strictest possible values below
+            proxy_hide_header Referrer-Policy;
             proxy_hide_header X-Frame-Options;
+
             include snippets/security-headers.conf;
             add_header Cross-Origin-Resource-Policy "cross-origin" always;
             add_header Content-Security-Policy "font-src 'none'; script-src 'none'; style-src 'none'; frame-ancestors 'none'; block-all-mixed-content" always;