diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8bc4109..d4928b2f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,6 +41,8 @@ All notable changes to this project will be documented in this file.
 - Annotated `.env` so it serves as the canonical, self-documenting Symfony
   env example, with a CI check that enforces it stays in sync with `config/`.
 - Switched image build pipeline to GHCR with multi-arch layer caching.
+- Aligned the nginx image env-var contract: split `NGINX_FPM_SERVICE` and
+  `NGINX_FPM_PORT`, raised upload cap and trusted-proxy CIDR defaults.
 
 ### NB! Prior to 3.x the project was split into separate repositories
 
diff --git a/docker-compose.override.yml b/docker-compose.override.yml
index 18ab0c07..ec0c8183 100644
--- a/docker-compose.override.yml
+++ b/docker-compose.override.yml
@@ -41,7 +41,8 @@ services:
     networks:
       - app
     depends_on:
-      - nginx
+      nginx:
+        condition: service_healthy
     volumes:
       - .:/app
       - /tmp/.X11-unix:/tmp/.X11-unix
diff --git a/docker-compose.server.yml b/docker-compose.server.yml
index d9a04931..fecabd84 100644
--- a/docker-compose.server.yml
+++ b/docker-compose.server.yml
@@ -33,11 +33,25 @@ services:
       - ./infrastructure/nginx/etc/nginx.conf:/etc/nginx/nginx.conf:ro
       - .:/app
     environment:
-      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1:9000
+      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1
+      NGINX_FPM_PORT: 9000
       NGINX_WEB_ROOT: /app/public
       NGINX_PORT: 8080
       NGINX_MAX_BODY_SIZE: 5M
       NGINX_SET_REAL_IP_FROM: 172.16.0.0/12
+    healthcheck:
+      # $$NGINX_PORT escapes compose-time interpolation; the variable is
+      # expanded by the shell inside the container against the service's
+      # environment.
+      test:
+        [
+          "CMD-SHELL",
+          'wget --quiet --tries=1 --spider "http://localhost:$$NGINX_PORT/health"',
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 6
+      start_period: 5s
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=frontend"
diff --git a/docker-compose.yml b/docker-compose.yml
index d2b8da50..1080b685 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -61,11 +61,25 @@ services:
       - ./infrastructure/nginx/etc/nginx.conf:/etc/nginx/nginx.conf:ro
       - .:/app
     environment:
-      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1:9000
+      NGINX_FPM_SERVICE: ${COMPOSE_PROJECT_NAME}-phpfpm-1
+      NGINX_FPM_PORT: 9000
       NGINX_WEB_ROOT: /app/public
       NGINX_PORT: 8080
       NGINX_MAX_BODY_SIZE: 5M
       NGINX_SET_REAL_IP_FROM: 172.16.0.0/12
+    healthcheck:
+      # $$NGINX_PORT escapes compose-time interpolation; the variable is
+      # expanded by the shell inside the container against the service's
+      # environment.
+      test:
+        [
+          "CMD-SHELL",
+          'wget --quiet --tries=1 --spider "http://localhost:$$NGINX_PORT/health"',
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 6
+      start_period: 5s
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=frontend"
diff --git a/infrastructure/nginx/Dockerfile b/infrastructure/nginx/Dockerfile
index 7004e5c4..92cabe37 100644
--- a/infrastructure/nginx/Dockerfile
+++ b/infrastructure/nginx/Dockerfile
@@ -71,8 +71,10 @@ ARG GID=101
 ENV APP_CLIENT_PATH=/app \
     APP_API_PATH=/var/www/html \
     NGINX_PORT=8080 \
-    NGINX_SET_REAL_IP_FROM=172.17.0.0/16 \
-    NGINX_MAX_BODY_SIZE=10m \
+    NGINX_FPM_SERVICE=os2display \
+    NGINX_FPM_PORT=9000 \
+    NGINX_MAX_BODY_SIZE=140m \
+    NGINX_SET_REAL_IP_FROM=172.16.0.0/12 \
     NGINX_WEB_ROOT=/var/www/html/public
 
 WORKDIR ${APP_API_PATH}
diff --git a/infrastructure/nginx/etc/templates/default.conf.template b/infrastructure/nginx/etc/templates/default.conf.template
index ebb38d51..2710ad92 100644
--- a/infrastructure/nginx/etc/templates/default.conf.template
+++ b/infrastructure/nginx/etc/templates/default.conf.template
@@ -1,5 +1,5 @@
 upstream api_backend {
-    server ${NGINX_FPM_SERVICE};
+    server ${NGINX_FPM_SERVICE}:${NGINX_FPM_PORT};
     keepalive 16;
 }