diff --git a/deploy/nginx-contracts.conf b/deploy/nginx-contracts.conf
index 135c0b3..a0e49c1 100644
--- a/deploy/nginx-contracts.conf
+++ b/deploy/nginx-contracts.conf
@@ -95,24 +95,17 @@ server {
     # ── VM-буфер загрузки contracts (паттерн drhider) ──────────────
     # Браузер кладёт файл сюда PUT (мимо шлюза кластера ~64КБ), бэк тянет сам.
     # Файлы: /var/www/contracts-upload/ (нужно создать, chown www-data).
-    # ⚠️ CORS: Access-Control-Allow-Origin должен совпадать с origin фронтенда.
+    # CORS: origin фронтенда = contractor.pythonk8s.dev.nubes.ru (ingress, подтверждено).
     location /contracts-upload/ {
-        client_max_body_size 1024m;
+        alias /var/www/contracts-upload/;
         dav_methods PUT DELETE;
         create_full_put_path on;
-        dav_access user:rw group:rw all:r;
-        root /var/www;
-
-        if ($request_method = OPTIONS) {
-            add_header Access-Control-Allow-Origin https://contractor.pythonk8s.dev.nubes.ru always;
-            add_header Access-Control-Allow-Methods "PUT, DELETE, OPTIONS" always;
-            add_header Access-Control-Allow-Headers "*" always;
-            add_header Content-Length 0;
-            return 204;
-        }
+        client_max_body_size 1024m;
         add_header Access-Control-Allow-Origin https://contractor.pythonk8s.dev.nubes.ru always;
-        add_header Access-Control-Allow-Methods "PUT, DELETE, OPTIONS" always;
-        add_header Access-Control-Allow-Headers "*" always;
+        add_header Access-Control-Allow-Methods 'PUT, GET, OPTIONS, DELETE' always;
+        add_header Access-Control-Allow-Headers 'Content-Type' always;
+        add_header Access-Control-Max-Age 86400 always;
+        if ($request_method = OPTIONS) { return 204; }
     }
 
     listen 443 ssl; # managed by Certbot