diff --git a/compose.yaml b/compose.yaml
index 8e657c7..93d209d 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -90,7 +90,7 @@ services:
       - no-new-privileges:true
     tmpfs:
       - /etc/nginx/conf.d:size=1m,mode=0755
-      - /var/cache/nginx:size=32m,mode=0755
+      - /var/cache/nginx:size=256m,mode=0755
       - /var/run:size=1m,mode=0755
 
   certbot:
diff --git a/deploy/nginx/templates/http.conf.template b/deploy/nginx/templates/http.conf.template
index 30acf69..e8a6778 100644
--- a/deploy/nginx/templates/http.conf.template
+++ b/deploy/nginx/templates/http.conf.template
@@ -77,6 +77,10 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header X-Forwarded-Proto http;
-        proxy_read_timeout 300s;
+        proxy_connect_timeout 30s;
+        proxy_send_timeout 30m;
+        proxy_read_timeout 30m;
+        proxy_request_buffering off;
+        proxy_buffering off;
     }
 }
diff --git a/deploy/nginx/templates/tls.conf.template b/deploy/nginx/templates/tls.conf.template
index 8209d15..2c8ad11 100644
--- a/deploy/nginx/templates/tls.conf.template
+++ b/deploy/nginx/templates/tls.conf.template
@@ -115,6 +115,10 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header X-Forwarded-Proto https;
-        proxy_read_timeout 300s;
+        proxy_connect_timeout 30s;
+        proxy_send_timeout 30m;
+        proxy_read_timeout 30m;
+        proxy_request_buffering off;
+        proxy_buffering off;
     }
 }
diff --git a/docs/deployment.md b/docs/deployment.md
index 862b7cd..9ea3f79 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -45,6 +45,10 @@ Nginx also runs with a read-only container filesystem and narrowly scoped
 temporary filesystems. The broker trusts proxy headers because Nginx is its
 only production ingress; Nginx replaces rather than appends client-supplied
 forwarding headers.
+Git request and response buffering is disabled so clone, fetch, and push pack
+streams pass directly between clients and Gitea. The Nginx cache tmpfs remains
+available for other proxy activity and is sized above typical repository pack
+files.
 
 ## 2. Install the repository
 
diff --git a/tests/test-deployment-scripts.sh b/tests/test-deployment-scripts.sh
index 52ff396..901e2a1 100755
--- a/tests/test-deployment-scripts.sh
+++ b/tests/test-deployment-scripts.sh
@@ -62,6 +62,26 @@ grep -F -- './config/letsencrypt/archive:/etc/archive:ro' \
 	printf 'FAIL: TLS compose does not expose Certbot archive symlink targets\n' >&2
 	exit 1
 }
+grep -F -- '/var/cache/nginx:size=256m,mode=0755' \
+	"${TEST_ROOT}/compose.yaml" >/dev/null || {
+	printf 'FAIL: Nginx cache tmpfs is too small for Git pack streaming\n' >&2
+	exit 1
+}
+for template in \
+	"${TEST_ROOT}/deploy/nginx/templates/http.conf.template" \
+	"${TEST_ROOT}/deploy/nginx/templates/tls.conf.template"; do
+	for directive in \
+		'proxy_send_timeout 30m;' \
+		'proxy_read_timeout 30m;' \
+		'proxy_request_buffering off;' \
+		'proxy_buffering off;'; do
+		[[ "$(grep -Fc -- "$directive" "$template")" == 2 ]] || {
+			printf 'FAIL: both proxied services need %s in %s\n' \
+				"$directive" "$template" >&2
+			exit 1
+		}
+	done
+done
 
 printf '%s\n' \
 	'broker.test' \