diff --git a/deploy_static b/deploy_static
index 497917fa..9af6c306 100755
--- a/deploy_static
+++ b/deploy_static
@@ -4,6 +4,10 @@ set -o errexit
 
 ./validate_static
 
+rm -rf static_tmp
+cp -a static static_tmp
+find static_tmp -regex '\(.+/LICENSE\|.+\.\(css\|html\|ico\|js\|svg\|txt\|webmanifest\|xml\)\)' -exec gzip -k9 {} +
+
 remote=www-data@grapheneos.org
 active=$(ssh $remote readlink html)
 
@@ -17,7 +21,7 @@ echo active is $active
 echo target is $target
 echo
 
-rsync -rpcve ssh --chmod=D755,F644 --delete static/ $remote:$target
+rsync -rpcve ssh --chmod=D755,F644 --delete static_tmp/ $remote:$target
 ssh $remote sync -f $target
 ssh $remote ln -snf $target html
 ssh $remote sync .
diff --git a/nginx/server.conf b/nginx/server.conf
index fee40bbc..928de083 100644
--- a/nginx/server.conf
+++ b/nginx/server.conf
@@ -80,13 +80,20 @@ server {
         add_header Cache-Control "public, max-age=604800";
     }
 
-    location ~ "\.(css|js|png|svg|woff2)$" {
+    location ~ "\.(css|js|svg)$" {
         include /etc/nginx/snippets/security-headers.conf;
         add_header Cache-Control "public, max-age=31536000";
     }
 
+    location ~ "\.(png|woff2)$" {
+        include /etc/nginx/snippets/security-headers.conf;
+        add_header Cache-Control "public, max-age=31536000";
+        gzip_static off;
+    }
+
     try_files $uri $uri.html $uri/ =404;
     include /etc/nginx/snippets/security-headers.conf;
+    gzip_static on;
 }
 
 server {