diff --git a/Dockerfile b/Dockerfile
index 9978213..ae1cff5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,5 +31,7 @@ EXPOSE 8080
 # stays root's, which is why the entrypoint writes through the file rather
 # than replacing it.
 COPY --from=build --chown=101:101 /build/dist /usr/share/nginx/html
-COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+# The nginx user's too, so listen-ipv6.sh can add the IPv6 listener at start.
+COPY --chown=101:101 docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --chmod=0755 docker/listen-ipv6.sh /docker-entrypoint.d/11-listen-ipv6.sh
 COPY --chmod=0755 docker/entrypoint.sh /docker-entrypoint.d/40-api-base-url.sh
diff --git a/docker/listen-ipv6.sh b/docker/listen-ipv6.sh
new file mode 100644
index 0000000..62a22a9
--- /dev/null
+++ b/docker/listen-ipv6.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+# Listen on IPv6 as well, when the host has it.
+#
+# nginx's own 10-listen-on-ipv6-by-default.sh does this only for the
+# default.conf it shipped, which ours replaces, so it skips it. The test is the
+# same one it uses: a kernel without IPv6 has no /proc/net/if_inet6, and nginx
+# refuses to start at all if asked to listen on an address family it cannot
+# open.
+set -eu
+
+conf=/etc/nginx/conf.d/default.conf
+
+[ -f /proc/net/if_inet6 ] || { echo "no IPv6 on this host, listening on IPv4 only"; exit 0; }
+grep -q 'listen \[::\]:8080' "$conf" && exit 0
+
+# Written back through the file, as 40-api-base-url.sh does with index.html:
+# conf.d belongs to root, the file to the nginx user.
+tmp=$(mktemp)
+trap 'rm -f "$tmp"' EXIT
+sed 's|^\( *\)listen  *8080;|&\n\1listen       [::]:8080;|' "$conf" > "$tmp"
+cat "$tmp" > "$conf"
+
+echo "listening on IPv6 as well"