diff --git a/roles/matrix-server/templates/nginx-conf.d/matrix-riot-web.conf.j2 b/roles/matrix-server/templates/nginx-conf.d/matrix-riot-web.conf.j2
index b96fd5a67..30ce8a755 100644
--- a/roles/matrix-server/templates/nginx-conf.d/matrix-riot-web.conf.j2
+++ b/roles/matrix-server/templates/nginx-conf.d/matrix-riot-web.conf.j2
@@ -5,8 +5,18 @@ server {
 	server_tokens off;
 
 	location /.well-known/acme-challenge {
+		{#
+			The proxy can access the files directly.
+			An external server likely does not have permission to read these files,
+			so we'll just proxy to acme's :402 port.
+		#}
+
+		{%- if matrix_nginx_proxy_enabled -%}
 		default_type "text/plain";
 		alias {{ matrix_ssl_certs_path }}/run/acme-challenge;
+		{%- else -%}
+		proxy_pass http://localhost:402;
+		{% endif %}
 	}
 
 	location / {
diff --git a/roles/matrix-server/templates/nginx-conf.d/matrix-synapse.conf.j2 b/roles/matrix-server/templates/nginx-conf.d/matrix-synapse.conf.j2
index a9e3b1ee8..cc2eb21a3 100644
--- a/roles/matrix-server/templates/nginx-conf.d/matrix-synapse.conf.j2
+++ b/roles/matrix-server/templates/nginx-conf.d/matrix-synapse.conf.j2
@@ -5,8 +5,18 @@ server {
 	server_tokens off;
 
 	location /.well-known/acme-challenge {
+		{#
+			The proxy can access the files directly.
+			An external server likely does not have permission to read these files,
+			so we'll just proxy to acme's :402 port.
+		#}
+
+		{%- if matrix_nginx_proxy_enabled -%}
 		default_type "text/plain";
 		alias {{ matrix_ssl_certs_path }}/run/acme-challenge;
+		{%- else -%}
+		proxy_pass http://localhost:402;
+		{% endif %}
 	}
 
 	location / {