diff --git a/roles/keyserver/files/sks.conf b/roles/keyserver/files/sks.conf
index 1e17732040..9870207e05 100644
--- a/roles/keyserver/files/sks.conf
+++ b/roles/keyserver/files/sks.conf
@@ -43,7 +43,6 @@ NameVirtualHost *:443
         RewriteEngine On
         RewriteCond %{HTTPS} off
         RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [NE]
-        # Set HSTS header via HTTP since it cannot be easily set in squid, which terminates HTTPS
         Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
 </VirtualHost>
 
@@ -63,6 +62,7 @@ NameVirtualHost *:443
 	ProxyPassReverse / http://localhost:11371/
         SetEnv proxy-nokeepalive 1
 	ProxyVia Full
+        Header always add Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
 </VirtualHost>
 <VirtualHost *:443>
         ServerAdmin sysadmin-keys-members@fedoraproject.org