diff --git a/docker_assets/nginx.conf b/docker_assets/nginx.conf
index 80f0af41..1890b9a5 100644
--- a/docker_assets/nginx.conf
+++ b/docker_assets/nginx.conf
@@ -26,12 +26,17 @@ server {
     }
 
     location /youtube/ {
-        # Use signed-URL auth if ?sig= is present, otherwise session auth
-        set $auth_endpoint /api/ping/;
-        if ($arg_sig) {
-            set $auth_endpoint /api/stream-auth/;
+        auth_request /api/ping/;
+        alias /youtube/;
+        types {
+            video/mp4 mp4;
         }
-        auth_request $auth_endpoint;
+    }
+
+    # Signed-URL streaming endpoint for native player clients (VLC etc.)
+    # Requires ?sig=&expires= query args validated by /api/stream-auth/.
+    location /stream/ {
+        auth_request /api/stream-auth/;
         alias /youtube/;
         types {
             video/mp4 mp4;