diff --git a/deploy/nginx/triangle-cms.conf b/deploy/nginx/triangle-cms.conf
index 4bd4bcd..9273794 100644
--- a/deploy/nginx/triangle-cms.conf
+++ b/deploy/nginx/triangle-cms.conf
@@ -75,7 +75,16 @@ server {
         # Filenames encode the exact size, so files are immutable. Set this only
         # via add_header -- `expires` would emit a second, weaker Cache-Control
         # and CDNs disagree about which duplicate wins.
-        add_header Cache-Control "public, max-age=2592000, immutable" always;
+        #
+        # Deliberately NOT `always`: that flag also stamps 30-day-immutable onto
+        # 404s, and Cloudflare then pins "this file does not exist" at the edge
+        # for a month. Any file added to the corpus after something first
+        # requested it stays invisible until the TTL expires or someone purges --
+        # a migrated image that is provably on disk and served fine by this nginx
+        # still 404s publicly, which reads as a failed copy rather than a cache
+        # hit. Without the flag add_header applies only to 2xx/3xx, so misses
+        # fall back to Cloudflare's short default 404 TTL and self-heal.
+        add_header Cache-Control "public, max-age=2592000, immutable";
     }
 
     # Never serve dotfiles (keep ACME http-01 working if it is ever added here).