diff --git a/conf/nginx-default.conf b/conf/nginx-default.conf
index 1b3ad5a..6bd3646 100644
--- a/conf/nginx-default.conf
+++ b/conf/nginx-default.conf
@@ -75,7 +75,7 @@
 	# we're blocking dotfiles in the static hosted sites but not the FastCGI-
 	# handled locations for Nextcloud (which serves user-uploaded files that might
 	# have this pattern, see #414) or some of the other services.
-	location ~ /\.(ht|svn|git|hg|bzr) {
+	location ~ /\.(ht|svn|git|hg|bzr|.*\.conf) {
 		log_not_found off;
 		access_log off;
 		deny all;
diff --git a/management/web_update.py b/management/web_update.py
index 4639cee..0e77e26 100644
--- a/management/web_update.py
+++ b/management/web_update.py
@@ -100,7 +100,7 @@ def do_web_update(env):
 					local_conf = f.read()
 
 			if domain not in has_root_proxy_or_redirect:
-				local_conf = make_domain_config(domain, [template0, template1], ssl_certificates, env)
+				local_conf = make_domain_config(domain, [template0, template4], ssl_certificates, env)
 			else:
 				local_conf = make_domain_config(domain, [template0], ssl_certificates, env)
 			nginx_conf += local_conf