diff --git a/neode-ui/docker/nginx-demo.conf b/neode-ui/docker/nginx-demo.conf
index 63723fde..ad1ba8ae 100644
--- a/neode-ui/docker/nginx-demo.conf
+++ b/neode-ui/docker/nginx-demo.conf
@@ -91,7 +91,10 @@ http {
         }
 
         # Proxy FileBrowser API to mock backend (demo mode)
-        location /app/filebrowser/ {
+        # ^~ on every /app/ prefix: the .css/.js/.img cache regex below must
+        # never swallow app-shell assets (they live on the backend, not in the
+        # web root — without ^~ nginx prefers the regex and 404s them).
+        location ^~ /app/filebrowser/ {
             client_max_body_size 10G;
             proxy_pass http://neode-backend:5959;
             proxy_http_version 1.1;
@@ -103,7 +106,7 @@ http {
         # IndeeHub: reverse-proxy the real site same-origin, strip framing headers,
         # and rewrite its absolute asset paths (/assets, /, src, href) to the
         # /app/indeedhub/ prefix so the SPA loads inside the iframe.
-        location /app/indeedhub/ {
+        location ^~ /app/indeedhub/ {
             proxy_pass https://indee.tx1138.com/;
             proxy_http_version 1.1;
             proxy_set_header Host indee.tx1138.com;
@@ -129,7 +132,7 @@ http {
         # Proxy every other app UI (/app/<id>/) to the mock backend, which serves
         # the per-app mock UIs (bitcoin-ui, electrumx, lnd, fedimint) and the
         # generic "Not available in the demo" notice for the rest.
-        location /app/ {
+        location ^~ /app/ {
             proxy_pass http://neode-backend:5959;
             proxy_http_version 1.1;
             proxy_set_header Host $host;