diff --git a/files/nginx/odk.conf.template b/files/nginx/odk.conf.template
index c1a4f4ab1..8f5b89827 100644
--- a/files/nginx/odk.conf.template
+++ b/files/nginx/odk.conf.template
@@ -19,7 +19,9 @@ map "$request_method::$uri$is_args$args" $cache_strategy {
   ~^(GET|HEAD)::/version\.txt$        "revalidate";
 
   # central-backend
-  ~^(GET|HEAD)::/v1/                 "passthrough";
+  ~^(GET|HEAD)::/v1/config/public/(hero-image|logo)\?(.*&|)ts=\d+ "immutable";
+  ~^(GET|HEAD)::/v1/config/public/(hero-image|logo)(\?|$)         "revalidate";
+  ~^(GET|HEAD)::/v1/ "passthrough";
 
   # central-frontend - unversioned
   ~^(GET|HEAD)::/$                            "revalidate";
diff --git a/test/nginx/src/mocha/nginx.spec.js b/test/nginx/src/mocha/nginx.spec.js
index 5e9664d08..c641a04a5 100644
--- a/test/nginx/src/mocha/nginx.spec.js
+++ b/test/nginx/src/mocha/nginx.spec.js
@@ -851,6 +851,29 @@ function standardTestSuite({ fetchHttp, fetchHttp6, apiFetch, apiFetch6, forward
     });
   });
 
+  describe('backend config blobs', () => {
+    [
+      // central-backend public images - frontend always requests with timestamp (`ts=...`)
+      [ '/v1/config/public/hero-image',                  'revalidate' ],
+      [ '/v1/config/public/hero-image?',                 'revalidate' ],
+      [ '/v1/config/public/hero-image?ts=',              'revalidate' ],
+      [ '/v1/config/public/hero-image?ts=1776774346923', 'immutable' ],
+      [ '/v1/config/public/logo?ts=1776774376314',       'immutable' ],
+    ].forEach(([ path, expectedCacheStrategy ]) => {
+      [ 'GET', 'HEAD' ].forEach(method => {
+        it(`${method} ${path} should be served with cache strategy: ${expectedCacheStrategy}`, async () => {
+          // when
+          const res = await apiFetch(path, { method });
+
+          // then
+          assert.equal(res.status, 200);
+          // and
+          assertCacheStrategyApplied(res, expectedCacheStrategy);
+        });
+      });
+    });
+  });
+
   describe('backend caching', () => {
     [
       [ '/v1/foo',                   'passthrough' ],