diff --git a/nixosConfigurations/hetzner-vpn2/nginx.nix b/nixosConfigurations/hetzner-vpn2/nginx.nix
index b80aa65..5576ee4 100644
--- a/nixosConfigurations/hetzner-vpn2/nginx.nix
+++ b/nixosConfigurations/hetzner-vpn2/nginx.nix
@@ -15,6 +15,8 @@ in
     defaults.email = "acme@zerforschen.plus";
   };
 
+  systemd.tmpfiles.rules = [ "d /var/lib/hyperhive-media 0755 root root -" ];
+
   systemd.services = {
     nginx.serviceConfig.SupplementaryGroups = [ "anubis" ];
     anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ];
@@ -51,6 +53,10 @@ in
           forceSSL = true;
           enableACME = true;
           root = hyperhive-website.packages.${pkgs.stdenv.hostPlatform.system}.default;
+          # the site root is a store path (replaced every deploy), so large
+          # media lives in its own dir, uploaded by hand:
+          #   scp gource-hyperhive.webm root@hetzner-vpn2:/var/lib/hyperhive-media/
+          locations."/media/".alias = "/var/lib/hyperhive-media/";
         };
 
         "trollhive.monster" = {