diff --git a/moltbot_assistant/config.yaml b/moltbot_assistant/config.yaml
index bc37e5f..c9a2aad 100644
--- a/moltbot_assistant/config.yaml
+++ b/moltbot_assistant/config.yaml
@@ -1,5 +1,5 @@
 name: Moltbot Assistant
-version: "0.4.0"
+version: "0.4.1"
 slug: moltbot_assistant
 description: Run Moltbot Assistant (Clawdbot-compatible) as a Home Assistant add-on.
 url: https://github.com/techartdev/ClawdHAAddOn
diff --git a/moltbot_assistant/nginx.conf.tpl b/moltbot_assistant/nginx.conf.tpl
index b026103..001127c 100644
--- a/moltbot_assistant/nginx.conf.tpl
+++ b/moltbot_assistant/nginx.conf.tpl
@@ -39,18 +39,13 @@ http {
     # out of ingress (to the HA host root). So we use a *relative* redirect.
 
     # Only redirect the root document to add token in the browser URL.
-    # NOTE: Home Assistant Ingress can expose the add-on at a path like:
-    #   /hassio/ingress/<slug>
-    # which may not end in a slash. Some clients compute relative URLs (including WS)
-    # incorrectly if the URL doesn't end in '/'. HA often provides the original ingress
-    # path via X-Ingress-Path; if present, redirect to that path with a trailing slash.
     location = / {
       if ($arg_token = "") {
         # Force a trailing slash via a relative redirect.
-        # This avoids absolute /hassio/... redirects that can confuse HA ingress routing.
         return 302 ./?token=__GATEWAY_TOKEN__;
       }
 
+      # Proxy the gateway UI.
       proxy_pass http://127.0.0.1:18789;
       proxy_http_version 1.1;
       proxy_set_header Upgrade $http_upgrade;
@@ -59,6 +54,20 @@ http {
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $remote_addr;
       proxy_set_header X-Forwarded-Proto $scheme;
+
+      # Inject the correct WS URL when running behind HA Ingress.
+      # HA provides a per-session ingress proxy path in X-Ingress-Path (usually /api/hassio_ingress/<token>).
+      # The UI loaded at /hassio/ingress/<slug> cannot be used as a WS endpoint on some setups,
+      # but /api/hassio_ingress/<token> *can* proxy websocket upgrades.
+      #
+      # We inject a small script to override the UI's saved websocket URL to:
+      #   wss://<host><x-ingress-path>/
+      # so the browser connects same-origin + through HA's ingress proxy.
+      proxy_set_header Accept-Encoding "";
+      sub_filter_types text/html;
+      sub_filter_once on;
+      sub_filter '</head>' '<script>(function(){try{var p="__INGRESS_PATH__"; if(p && p!=="__INGRESS_PATH__"){ var ws=(location.protocol==="https:"?"wss://":"ws://")+location.host+p+"/"; try{var k="clawdbot.control.settings.v1"; var s=localStorage.getItem(k); var o=s?JSON.parse(s):{}; o.url=ws; localStorage.setItem(k, JSON.stringify(o));}catch(e){} } }catch(e){} })();</script></head>';
+      sub_filter '__INGRESS_PATH__' "$http_x_ingress_path";
     }
 
     # WebSocket endpoint compatibility: