diff --git a/examples/nginx/mattermost-host.conf b/examples/nginx/mattermost-host.conf
index 6e8ee70..63d938d 100644
--- a/examples/nginx/mattermost-host.conf
+++ b/examples/nginx/mattermost-host.conf
@@ -17,8 +17,9 @@ server {
 }
 
 server {
-   listen 443 ssl http2;
-   listen [::]:443 ssl http2;
+   listen 443 ssl ;
+   listen [::]:443 ssl ;
+   http2 on;
 
    server_name @FQHN_HOSTNAME@;
 
@@ -28,8 +29,6 @@ server {
    #
    include snippets/letsencrypt-acme-challenge.conf;
 
-   #ssl on;
-
    ssl_certificate /var/lib/dehydrated/certs/@FQHN_HOSTNAME@/fullchain.pem;
    ssl_certificate_key /var/lib/dehydrated/certs/@FQHN_HOSTNAME@/privkey.pem;
    ssl_trusted_certificate /var/lib/dehydrated/certs/@FQHN_HOSTNAME@/chain.pem;
@@ -51,15 +50,24 @@ server {
    # omit  TLSv1 TLSv1.1
    ssl_protocols TLSv1.2 TLSv1.3;
 
+   # Enable TLSv1.3's 0-RTT. Use $ssl_early_data when reverse proxying to
+   # prevent replay attacks.
+   #
+   # @see: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data
+   ssl_early_data on;
+
    # ECDHE better than DHE (faster)  ECDHE & DHE GCM better than CBC (attacks on AES)
    # Everything better than SHA1 (deprecated)
    #
-   ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
-   ssl_prefer_server_ciphers on;
+   ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
+   ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+   ssl_prefer_server_ciphers off;
 
    # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
    #
    add_header Strict-Transport-Security max-age=15768000;
+   add_header X-Early-Data $tls1_3_early_data;
+   add_header X-Frame-Options SAMEORIGIN;
 
    # OCSP Stapling ---
    # fetch OCSP records from URL in ssl_certificate and cache them
@@ -74,7 +82,6 @@ server {
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Frame-Options SAMEORIGIN;
       proxy_buffers 256 16k;
       proxy_buffer_size 16k;
       client_body_timeout 60;
@@ -93,7 +100,6 @@ server {
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Frame-Options SAMEORIGIN;
       proxy_buffers 256 16k;
       proxy_buffer_size 16k;
       proxy_read_timeout 600s;