diff --git a/VERSION b/VERSION
index b58b3df..db09777 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.3.81-beta
+0.3.82-beta
diff --git a/deploy/nginx.conf b/deploy/nginx.conf
index 319bed8..ad17e58 100644
--- a/deploy/nginx.conf
+++ b/deploy/nginx.conf
@@ -12,6 +12,16 @@ server {
     # Wat groter zodat grote borden/afbeeldingen niet geweigerd worden
     client_max_body_size 55m;
 
+    # Gzip-vangnet: de app comprimeert zelf al (brotli/gzip via @fastify/compress)
+    # en nginx comprimeert nooit dubbel (responses mét Content-Encoding blijven
+    # ongemoeid) - dit vangt alleen wat de app mist. Let op: zonder
+    # gzip_proxied comprimeert nginx geproxyde responses helemaal niet.
+    gzip on;
+    gzip_proxied any;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_types text/css application/javascript application/json image/svg+xml text/plain;
+
     location / {
         proxy_pass http://app:3000;
         proxy_http_version 1.1;
diff --git a/public/js/core.js b/public/js/core.js
index 565ba61..530ac94 100644
--- a/public/js/core.js
+++ b/public/js/core.js
@@ -2,7 +2,7 @@
 "use strict";
 /* version — shown until /api/version resolves (or if the fetch fails, e.g. offline).
    Kept in sync by hand with the VERSION file at the repo root on every release. */
-const VERSION = "0.3.81-beta";
+const VERSION = "0.3.82-beta";
 (function(){
   const tag = document.getElementById("verTag");
   tag.textContent = "v"+VERSION;
diff --git a/test/security-config.test.js b/test/security-config.test.js
index 786689e..df6eebe 100644
--- a/test/security-config.test.js
+++ b/test/security-config.test.js
@@ -15,6 +15,13 @@ test('nginx behoudt het publieke forwarded protocol', async () => {
   assert.match(nginx, /X-Forwarded-Proto \$teach_forwarded_proto/);
 });
 
+test('nginx comprimeert geproxyde responses als vangnet', async () => {
+  const nginx = await readFile('deploy/nginx.conf', 'utf8');
+  /* zonder gzip_proxied comprimeert nginx geproxyde responses helemaal niet */
+  assert.match(nginx, /gzip_proxied any/);
+  assert.match(nginx, /gzip_vary on/);
+});
+
 test('client bewaart geen bearer-token meer', async () => {
   const core = await readFile('public/js/core.js', 'utf8');
   assert.doesNotMatch(core, /headers\.Authorization|localStorage\.setItem\("teach\.token"/);