diff --git a/proxy/nginx.conf b/proxy/nginx.conf
index 6439c2a..d3d9740 100644
--- a/proxy/nginx.conf
+++ b/proxy/nginx.conf
@@ -32,8 +32,12 @@ http {
     # "/" -> new-frontend block below); the bare-path redirect below only
     # exists to catch "/portal" (no trailing slash), which wouldn't match
     # "location /portal/" and would otherwise silently fall through to "/".
+    # $http_host (not $host) is used explicitly so the Location header keeps
+    # the client-facing port (e.g. :8080) - nginx's own implicit redirect
+    # construction uses its internal `listen` port instead, which silently
+    # drops the port the host actually published this container under.
     location = /portal {
-      return 301 /portal/;
+      return 301 $scheme://$http_host/portal/;
     }
 
     location /portal/ {