diff --git a/apps/web/src/app/(main)/onboarding/page.tsx b/apps/web/src/app/(main)/onboarding/page.tsx
index a5cc719..32653bf 100644
--- a/apps/web/src/app/(main)/onboarding/page.tsx
+++ b/apps/web/src/app/(main)/onboarding/page.tsx
@@ -207,13 +207,13 @@ export default function OnboardingPage(): React.ReactElement {
                 }}
               >
                 <div className="mb-5">
-                  <div className="mb-4 overflow-hidden rounded-lg border border-border-subtle">
+                  <div className="-m-6 mb-5 overflow-hidden bg-black">
                     <img
                       src="/brand/hero.png"
                       alt="Tactical Media Broadcast Hub — arrows from a circle, warm red on black"
                       width={1024}
                       height={1024}
-                      className="h-36 w-full object-cover"
+                      className="mx-auto h-auto w-full max-h-[420px] object-contain"
                     />
                   </div>
                   <div className="text-center">
diff --git a/infra/occupymedia/edge/nginx.conf b/infra/occupymedia/edge/nginx.conf
index 5ec1d28..2d25aed 100644
--- a/infra/occupymedia/edge/nginx.conf
+++ b/infra/occupymedia/edge/nginx.conf
@@ -98,6 +98,38 @@ http {
     }
   }
 
+  server {
+    listen 80;
+    listen [::]:80;
+    server_name chat.occupymedia.cc;
+    # Tunnel origin path: browsers hitting the bare server root get the branded
+    # client; the Matrix API flows through untouched.
+    location = / {
+      return 302 https://element.occupymedia.cc;
+    }
+    # Client discovery for @user:chat.occupymedia.cc logins (tuwunel does not serve it).
+    location = /.well-known/matrix/client {
+      default_type application/json;
+      return 200 '{"m.homeserver":{"base_url":"https://chat.occupymedia.cc"}}';
+    }
+    location = /.well-known/matrix/server {
+      default_type application/json;
+      return 200 '{"m.server":"chat.occupymedia.cc:443"}';
+    }
+
+    location / {
+      proxy_pass http://100.117.210.52:6167;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto http;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_read_timeout 3600s;
+      proxy_send_timeout 3600s;
+    }
+  }
+
   server {
     listen 443 ssl;
     listen [::]:443 ssl;
@@ -106,6 +138,18 @@ http {
     ssl_certificate     /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
 
+    location = / {
+      return 302 https://element.occupymedia.cc;
+    }
+    location = /.well-known/matrix/client {
+      default_type application/json;
+      return 200 '{"m.homeserver":{"base_url":"https://chat.occupymedia.cc"}}';
+    }
+    location = /.well-known/matrix/server {
+      default_type application/json;
+      return 200 '{"m.server":"chat.occupymedia.cc:443"}';
+    }
+
     location / {
       proxy_pass http://100.117.210.52:6167;
       proxy_http_version 1.1;
@@ -192,6 +236,23 @@ http {
     }
   }
 
+  server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name element.occupymedia.cc;
+
+    ssl_certificate     /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
+
+    location / {
+      proxy_pass http://occ-element:80;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto https;
+    }
+  }
+
   # Everything else on this IP: drop the connection.
   server {
     listen 443 ssl default_server;