diff --git a/nginx.conf b/nginx.conf
index bd311b4..80600dc 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -16,7 +16,19 @@ server {
     location = /manifest.json {
         add_header Cache-Control "no-cache";
     }
-    location ~ \.apk$ {
+    # The `latest` aliases MOVE — they are symlinks the release script
+    # repoints — so they must never be cached as immutable. Exact-match
+    # locations win over the regex below in nginx, which is what keeps a
+    # one-year immutable header off the one URL people are told to use.
+    location = /latest.apk {
+        add_header Cache-Control "no-cache";
+    }
+    location = /latest-linux.tar.gz {
+        add_header Cache-Control "no-cache";
+    }
+
+    # A versioned artifact never changes: a new release is a new filename.
+    location ~ \.(apk|tar\.gz)$ {
         add_header Cache-Control "public, max-age=31536000, immutable";
     }