diff --git a/Dockerfile b/Dockerfile
index 279b276..8ccbd02 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,6 +6,8 @@ RUN apk add --no-cache git
 
 WORKDIR /src
 RUN git clone --depth 1 --branch "${TELEBIT_REF}" https://github.com/therootcompany/telebit.git .
+COPY patches/behind-nginx.patch /tmp/behind-nginx.patch
+RUN git apply --recount /tmp/behind-nginx.patch
 
 RUN go generate -mod=vendor ./...
 RUN CGO_ENABLED=0 go build -mod=vendor -ldflags="-s -w" -o /out/telebit-relay ./cmd/telebit
diff --git a/patches/behind-nginx.patch b/patches/behind-nginx.patch
new file mode 100644
index 0000000..54f4cea
--- /dev/null
+++ b/patches/behind-nginx.patch
@@ -0,0 +1,84 @@
+diff --git a/cmd/telebit/telebit.go b/cmd/telebit/telebit.go
+--- a/cmd/telebit/telebit.go
++++ b/cmd/telebit/telebit.go
+@@ -854,7 +854,6 @@ func muxAll(
+ 			httpsrv.Serve(apiListener)
+ 		}()
+ 		fmt.Printf("Will respond to Websocket and API requests to %q\n", config.apiHostname)
+-		mux.HandleTLS(config.apiHostname, acme, mux, "[Terminate TLS & Recurse] for "+config.apiHostname)
+ 		mux.HandleTCP(config.apiHostname, telebit.HandlerFunc(func(client net.Conn) error {
+ 			if dbg.Debug {
+ 				fmt.Printf("[debug] Accepting API or WebSocket client %q\n", config.apiHostname)
+diff --git a/internal/telebit/connwrap.go b/internal/telebit/connwrap.go
+--- a/internal/telebit/connwrap.go
++++ b/internal/telebit/connwrap.go
+@@ -4,6 +4,7 @@ import (
+ 	"bufio"
+ 	"encoding/hex"
+ 	"net"
++	"strings"
+ 	"time"
+ 
+ 	"git.rootprojects.org/root/telebit/internal/dbg"
+@@ -126,7 +127,44 @@ func (c *ConnWrap) Servername() string {
+ 
+ 	// this will get the servername
+ 	_ = c.isEncrypted()
++	if "" == c.servername {
++		c.servername = c.httpHost()
++	}
+ 	return c.servername
+ }
+ 
++func (c *ConnWrap) httpHost() string {
++	c.SetDeadline(time.Now().Add(200 * time.Millisecond))
++	b, _ := c.Peek(defaultPeekerSize)
++	defer c.SetDeadline(time.Time{})
++
++	if 0 == len(b) {
++		return ""
++	}
++
++	lines := strings.Split(string(b), "\r\n")
++	if len(lines) < 2 {
++		return ""
++	}
++
++	for _, line := range lines[1:] {
++		if "" == line {
++			break
++		}
++		if !strings.HasPrefix(strings.ToLower(line), "host:") {
++			continue
++		}
++
++		host := strings.TrimSpace(line[len("host:"):])
++		if "" == host {
++			return ""
++		}
++		if h, _, err := net.SplitHostPort(host); nil == err {
++			host = h
++		}
++		host = strings.Trim(host, "[]")
++		return strings.ToLower(host)
++	}
++
++	return ""
++}
++
+ // isEncrypted returns true if peeking at net.Conn reveals that it is TLS-encrypted
+ func (c *ConnWrap) isEncrypted() bool {
+ 	if nil != c.encrypted {
+diff --git a/internal/telebit/routemux.go b/internal/telebit/routemux.go
+--- a/internal/telebit/routemux.go
++++ b/internal/telebit/routemux.go
+@@ -65,6 +65,9 @@ func (m *RouteMux) Serve(client net.Conn) error {
+ 		parts := strings.Split(addr, ":")
+ 		port = ":" + parts[len(parts)-1]
+ 		servername = strings.Join(parts[:len(parts)-1], ":")
++		if detected := wconn.Servername(); "" != detected {
++			servername = detected
++		}
+ 	}
+ 	fmt.Println("\nAddr:", fam, servername, port)
+