diff --git a/nginx/default.conf b/nginx/default.conf
index 6f0622b..2dc791e 100644
--- a/nginx/default.conf
+++ b/nginx/default.conf
@@ -7,13 +7,13 @@ server {
     root /usr/share/nginx/html/dev;
     index index.html;
 
-    # Map canonical .well-known paths to variant-specific files
+    # Map canonical .well-known paths to variant-specific files (alias cannot use variables)
     location = /.well-known/security.txt {
-        alias $document_root/.well-known/dev.security.txt;
+        alias /usr/share/nginx/html/dev/.well-known/dev.security.txt;
         add_header Cache-Control "public, max-age=86400";
     }
     location = /.well-known/appspecific/com.chrome.devtools.json {
-        alias $document_root/.well-known/dev.com.chrome.devtools.json;
+        alias /usr/share/nginx/html/dev/.well-known/dev.com.chrome.devtools.json;
         add_header Cache-Control "public, max-age=86400";
     }
 
@@ -32,13 +32,13 @@ server {
     root /usr/share/nginx/html/bio;
     index index.html;
 
-    # Map canonical .well-known paths to variant-specific files
+    # Map canonical .well-known paths to variant-specific files (alias cannot use variables)
     location = /.well-known/security.txt {
-        alias $document_root/.well-known/bio.security.txt;
+        alias /usr/share/nginx/html/bio/.well-known/bio.security.txt;
         add_header Cache-Control "public, max-age=86400";
     }
     location = /.well-known/appspecific/com.chrome.devtools.json {
-        alias $document_root/.well-known/bio.com.chrome.devtools.json;
+        alias /usr/share/nginx/html/bio/.well-known/bio.com.chrome.devtools.json;
         add_header Cache-Control "public, max-age=86400";
     }