diff --git a/nginx/ulicraft.conf.tmpl b/nginx/ulicraft.conf.tmpl
index ef87894..b21de2d 100644
--- a/nginx/ulicraft.conf.tmpl
+++ b/nginx/ulicraft.conf.tmpl
@@ -24,7 +24,9 @@ server {
     return 301 https://$host$request_uri;
 }
 
-# Apex — static landing page.
+# Apex — static landing page (./www) + launcher downloads (./mirror/launcher).
+# /ca.crt from the caddy path is intentionally omitted: LE certs are publicly
+# trusted, so guests need no CA import.
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
@@ -34,9 +36,17 @@ server {
     ssl_certificate     ${APP_DIR}/certs/${BASE_DOMAIN}/cert.pem;
     ssl_certificate_key ${APP_DIR}/certs/${BASE_DOMAIN}/key.pem;
 
-    root ${APP_DIR}/www;
-    index index.html;
-    location / { try_files $uri $uri/ =404; }
+    # Launcher downloads (populated by tooling/fetch-launcher.sh -> ./mirror/launcher).
+    location /launcher/ {
+        alias ${APP_DIR}/mirror/launcher/;
+        autoindex on;
+    }
+
+    location / {
+        root ${APP_DIR}/www;
+        index index.html;
+        try_files $uri $uri/ =404;
+    }
 }
 
 # Pack — packwiz metadata (./pack) + custom jars (./custom at /custom/).