diff --git a/compose/package-cache-frontend/upstreams.conf b/compose/package-cache-frontend/upstreams.conf
index 9e0acd5a03..b5c5ef08e7 100644
--- a/compose/package-cache-frontend/upstreams.conf
+++ b/compose/package-cache-frontend/upstreams.conf
@@ -9,8 +9,49 @@ proxy_request_buffering off;
 proxy_read_timeout 300s;
 proxy_connect_timeout 30s;
 
+# Docker embedded DNS, pinned to bypass image-specific resolv.conf order.
 resolver 127.0.0.11 ipv6=off valid=30s;
 
+# Nexus answers 502 when a proxy's remote is unreachable (measured) and has no
+# group repository type for apt, so the mirror failover sits here rather than in
+# the repo layout. 5xx only: a 404 means the file genuinely is not in the suite,
+# and apt probes for missing files often enough that retrying those would double
+# the request rate.
+#
+# Nexus answers that 502 only after trying every address of the remote in turn,
+# one connect timeout each; for a remote with several addresses that outlasts a
+# client's own timeout before the mirror is ever asked.
+#
+# These stay prefix locations. A regex location forfeits nginx's implicit
+# `/debian` -> `/debian/` redirect, and the URL-reachability test probes exactly
+# that slash-less form through the runner's DNS hijack, so it turns into a 404.
+server {
+	listen 80;
+	server_name deb.debian.org;
+	location /debian/ {
+		rewrite ^/debian/(.*)$ /repository/apt-debian/$1 break;
+		proxy_intercept_errors on;
+		proxy_read_timeout 8s;
+		error_page 502 503 504 = @debian_mirror;
+		proxy_pass http://package-cache:8081;
+	}
+	location @debian_mirror {
+		rewrite ^/repository/apt-debian/(.*)$ /repository/apt-debian-mirror/$1 break;
+		proxy_pass http://package-cache:8081;
+	}
+	location /debian-security/ {
+		rewrite ^/debian-security/(.*)$ /repository/apt-debian-security/$1 break;
+		proxy_intercept_errors on;
+		proxy_read_timeout 8s;
+		error_page 502 503 504 = @debian_security_mirror;
+		proxy_pass http://package-cache:8081;
+	}
+	location @debian_security_mirror {
+		rewrite ^/repository/apt-debian-security/(.*)$ /repository/apt-debian-security-mirror/$1 break;
+		proxy_pass http://package-cache:8081;
+	}
+}
+
 server {
 	listen 80;
 	server_name archive.ubuntu.com;
@@ -18,59 +59,26 @@ server {
 		rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu/$1 break;
 		proxy_intercept_errors on;
 		proxy_read_timeout 8s;
-		error_page 502 503 504 = @apt_ubuntu_mirror;
+		error_page 502 503 504 = @ubuntu_mirror;
 		proxy_pass http://package-cache:8081;
 	}
-	location @apt_ubuntu_mirror {
+	location @ubuntu_mirror {
 		rewrite ^/repository/apt-ubuntu/(.*)$ /repository/apt-ubuntu-mirror/$1 break;
 		proxy_pass http://package-cache:8081;
 	}
 }
-
-server {
-	listen 443 ssl;
-	server_name argos-net.com;
-	ssl_certificate     /etc/nginx/certs/argos-net.com.crt;
-	ssl_certificate_key /etc/nginx/certs/argos-net.com.key;
-	location / {
-		proxy_read_timeout 1800s;
-		proxy_pass http://package-cache:8081/repository/raw-argos-net/;
-	}
-}
-
-server {
-	listen 443 ssl;
-	server_name codeload.github.com;
-	ssl_certificate     /etc/nginx/certs/codeload.github.com.crt;
-	ssl_certificate_key /etc/nginx/certs/codeload.github.com.key;
-	location / {
-		proxy_pass http://package-cache:8081/repository/raw-codeload-github/;
-	}
-}
-
 server {
 	listen 80;
-	server_name deb.debian.org;
-	location /debian/ {
-		rewrite ^/debian/(.*)$ /repository/apt-debian/$1 break;
+	server_name security.ubuntu.com;
+	location /ubuntu/ {
+		rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu-security/$1 break;
 		proxy_intercept_errors on;
 		proxy_read_timeout 8s;
-		error_page 502 503 504 = @apt_debian_mirror;
+		error_page 502 503 504 = @ubuntu_security_mirror;
 		proxy_pass http://package-cache:8081;
 	}
-	location @apt_debian_mirror {
-		rewrite ^/repository/apt-debian/(.*)$ /repository/apt-debian-mirror/$1 break;
-		proxy_pass http://package-cache:8081;
-	}
-	location /debian-security/ {
-		rewrite ^/debian-security/(.*)$ /repository/apt-debian-security/$1 break;
-		proxy_intercept_errors on;
-		proxy_read_timeout 8s;
-		error_page 502 503 504 = @apt_debian_security_mirror;
-		proxy_pass http://package-cache:8081;
-	}
-	location @apt_debian_security_mirror {
-		rewrite ^/repository/apt-debian-security/(.*)$ /repository/apt-debian-security-mirror/$1 break;
+	location @ubuntu_security_mirror {
+		rewrite ^/repository/apt-ubuntu-security/(.*)$ /repository/apt-ubuntu-security-mirror/$1 break;
 		proxy_pass http://package-cache:8081;
 	}
 }
@@ -86,11 +94,11 @@ server {
 
 server {
 	listen 443 ssl;
-	server_name dl-cdn.alpinelinux.org;
-	ssl_certificate     /etc/nginx/certs/dl-cdn.alpinelinux.org.crt;
-	ssl_certificate_key /etc/nginx/certs/dl-cdn.alpinelinux.org.key;
+	server_name pypi.org;
+	ssl_certificate     /etc/nginx/certs/pypi.org.crt;
+	ssl_certificate_key /etc/nginx/certs/pypi.org.key;
 	location / {
-		proxy_pass http://package-cache:8081/repository/raw-alpine/;
+		proxy_pass http://package-cache:8081/repository/pypi-proxy/;
 	}
 }
 
@@ -104,71 +112,13 @@ server {
 	}
 }
 
-server {
-	listen 443 ssl;
-	server_name huggingface.co;
-	ssl_certificate     /etc/nginx/certs/huggingface.co.crt;
-	ssl_certificate_key /etc/nginx/certs/huggingface.co.key;
-	location / {
-		proxy_pass http://package-cache:8081/repository/raw-huggingface/;
-	}
-}
-
-server {
-	listen 443 ssl;
-	server_name index.crates.io;
-	ssl_certificate     /etc/nginx/certs/index.crates.io.crt;
-	ssl_certificate_key /etc/nginx/certs/index.crates.io.key;
-	location / {
-		proxy_pass http://package-cache:8081/repository/raw-crates-index/;
-	}
-}
-
-server {
-	listen 443 ssl;
-	server_name index.rubygems.org;
-	ssl_certificate     /etc/nginx/certs/index.rubygems.org.crt;
-	ssl_certificate_key /etc/nginx/certs/index.rubygems.org.key;
-	location / {
-		proxy_pass http://package-cache:8081/repository/gem-proxy/;
-	}
-}
-
-server {
-	listen 443 ssl;
-	server_name proxy.golang.org;
-	ssl_certificate     /etc/nginx/certs/proxy.golang.org.crt;
-	ssl_certificate_key /etc/nginx/certs/proxy.golang.org.key;
-	location / {
-		proxy_pass http://package-cache:8081/repository/go-proxy/;
-	}
-}
-
-server {
-	listen 443 ssl;
-	server_name pypi.org;
-	ssl_certificate     /etc/nginx/certs/pypi.org.crt;
-	ssl_certificate_key /etc/nginx/certs/pypi.org.key;
-	location / {
-		proxy_pass http://package-cache:8081/repository/pypi-proxy/;
-	}
-}
-
-server {
-	listen 443 ssl;
-	server_name raw.githubusercontent.com;
-	ssl_certificate     /etc/nginx/certs/raw.githubusercontent.com.crt;
-	ssl_certificate_key /etc/nginx/certs/raw.githubusercontent.com.key;
-	location / {
-		proxy_pass http://package-cache:8081/repository/raw-githubusercontent/;
-	}
-}
-
 server {
 	listen 443 ssl;
 	server_name registry.npmjs.org;
 	ssl_certificate     /etc/nginx/certs/registry.npmjs.org.crt;
 	ssl_certificate_key /etc/nginx/certs/registry.npmjs.org.key;
+	# Tarball URLs Nexus emits already carry /repository/npm-proxy/; pass them
+	# through as-is (no path on proxy_pass) so they aren't double-prefixed → 404.
 	location /repository/npm-proxy/ {
 		proxy_pass http://package-cache:8081;
 	}
@@ -179,11 +129,20 @@ server {
 
 server {
 	listen 443 ssl;
-	server_name registry.ollama.ai;
-	ssl_certificate     /etc/nginx/certs/registry.ollama.ai.crt;
-	ssl_certificate_key /etc/nginx/certs/registry.ollama.ai.key;
+	server_name rubygems.org;
+	ssl_certificate     /etc/nginx/certs/rubygems.org.crt;
+	ssl_certificate_key /etc/nginx/certs/rubygems.org.key;
 	location / {
-		proxy_pass http://package-cache:8081/repository/raw-ollama-registry/;
+		proxy_pass http://package-cache:8081/repository/gem-proxy/;
+	}
+}
+server {
+	listen 443 ssl;
+	server_name index.rubygems.org;
+	ssl_certificate     /etc/nginx/certs/index.rubygems.org.crt;
+	ssl_certificate_key /etc/nginx/certs/index.rubygems.org.key;
+	location / {
+		proxy_pass http://package-cache:8081/repository/gem-proxy/;
 	}
 }
 
@@ -199,36 +158,40 @@ server {
 
 server {
 	listen 443 ssl;
-	server_name rubygems.org;
-	ssl_certificate     /etc/nginx/certs/rubygems.org.crt;
-	ssl_certificate_key /etc/nginx/certs/rubygems.org.key;
+	server_name proxy.golang.org;
+	ssl_certificate     /etc/nginx/certs/proxy.golang.org.crt;
+	ssl_certificate_key /etc/nginx/certs/proxy.golang.org.key;
 	location / {
-		proxy_pass http://package-cache:8081/repository/gem-proxy/;
-	}
-}
-
-server {
-	listen 80;
-	server_name security.ubuntu.com;
-	location /ubuntu/ {
-		rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu-security/$1 break;
-		proxy_intercept_errors on;
-		proxy_read_timeout 8s;
-		error_page 502 503 504 = @apt_ubuntu_security_mirror;
-		proxy_pass http://package-cache:8081;
-	}
-	location @apt_ubuntu_security_mirror {
-		rewrite ^/repository/apt-ubuntu-security/(.*)$ /repository/apt-ubuntu-security-mirror/$1 break;
-		proxy_pass http://package-cache:8081;
+		proxy_pass http://package-cache:8081/repository/go-proxy/;
 	}
 }
 
 server {
 	listen 443 ssl;
-	server_name static.crates.io;
-	ssl_certificate     /etc/nginx/certs/static.crates.io.crt;
-	ssl_certificate_key /etc/nginx/certs/static.crates.io.key;
+	server_name dl-cdn.alpinelinux.org;
+	ssl_certificate     /etc/nginx/certs/dl-cdn.alpinelinux.org.crt;
+	ssl_certificate_key /etc/nginx/certs/dl-cdn.alpinelinux.org.key;
 	location / {
-		proxy_pass http://package-cache:8081/repository/raw-crates-static/;
+		proxy_pass http://package-cache:8081/repository/raw-alpine/;
+	}
+}
+
+server {
+	listen 443 ssl;
+	server_name raw.githubusercontent.com;
+	ssl_certificate     /etc/nginx/certs/raw.githubusercontent.com.crt;
+	ssl_certificate_key /etc/nginx/certs/raw.githubusercontent.com.key;
+	location / {
+		proxy_pass http://package-cache:8081/repository/raw-githubusercontent/;
+	}
+}
+
+server {
+	listen 443 ssl;
+	server_name codeload.github.com;
+	ssl_certificate     /etc/nginx/certs/codeload.github.com.crt;
+	ssl_certificate_key /etc/nginx/certs/codeload.github.com.key;
+	location / {
+		proxy_pass http://package-cache:8081/repository/raw-codeload-github/;
 	}
 }