diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 4e2e1372..149edce6 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -65,6 +65,11 @@ http {
 
     if_modified_since before;
 
+    map $http_cookie $preload_resources {
+        "~*__Host-preload=1" "";
+        default "</grapheneos.css?29>; rel=preload; as=style, </fonts/roboto_latin.woff2?20>; rel=preload; as=font; crossorigin, </fonts/roboto_bold_latin.woff2?20>; rel=preload; as=font; crossorigin";
+    }
+
     server {
         listen 80 backlog=4096;
         listen [::]:80 backlog=4096;
diff --git a/nginx/snippets/preload.conf b/nginx/snippets/preload.conf
index f0409213..12406fca 100644
--- a/nginx/snippets/preload.conf
+++ b/nginx/snippets/preload.conf
@@ -1,2 +1,3 @@
-add_header Link "</grapheneos.css?29>; rel=preload; as=style, </fonts/roboto_latin.woff2?20>; rel=preload; as=font; crossorigin, </fonts/roboto_bold_latin.woff2?20>; rel=preload; as=font; crossorigin" always;
-http2_push /grapheneos.css?29;
+add_header Link $preload_resources always;
+add_header Set-Cookie "__Host-preload=1; HttpOnly; Secure; Path=/" always;
+http2_push_preload on;