diff --git a/public/sw.js b/public/sw.js
index b747c319..d27bb301 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -1,5 +1,10 @@
-const CACHE = "atom-v3";
-const API_CACHE = "atom-api-v3";
+// Bumped to v4. The v3 worker cached /_next/static/ and /assets/ cache-first
+// under a hardcoded cache name that was not tied to the build, so a release
+// left the browser replaying the previous release's chunks against the new
+// HTML. That combination renders a blank page. The cache name is the version,
+// so it must move whenever this behaviour changes.
+const CACHE = "atom-v4";
+const API_CACHE = "atom-api-v4";
 
 self.addEventListener("install", () => self.skipWaiting());
 
@@ -18,31 +23,32 @@ self.addEventListener("activate", (event) => {
 	);
 });
 
+// Static build output is NOT cached here on purpose.
+//
+// nginx already sends `/_next/static/` and `/assets/` with
+// `max-age=31536000, immutable`. Those filenames are content-hashed, so the
+// HTTP cache is both sufficient and safe: a changed file gets a new name.
+// Wrapping them in a Cache Storage entry bought nothing and introduced a
+// staleness bug the HTTP cache cannot have — the cache name had no build id,
+// so a release kept serving the previous release's chunks.
+//
+// Letting these requests fall through also means a failed fetch surfaces as a
+// normal network error the browser can retry, instead of a rejected
+// respondWith() that silently drops the <script> and leaves React unhydrated.
+const isStaticBuildOutput = (pathname) =>
+	pathname.startsWith("/assets/") ||
+	pathname.startsWith("/_next/static/") ||
+	pathname.startsWith("/_next/data/");
+
 self.addEventListener("fetch", (event) => {
 	const req = event.request;
 	if (req.method !== "GET") return;
 	const url = new URL(req.url);
 	if (url.origin !== self.location.origin) return;
+	if (isStaticBuildOutput(url.pathname)) return;
 
-	if (
-		url.pathname.startsWith("/assets/") ||
-		url.pathname.startsWith("/_next/static/")
-	) {
-		event.respondWith(
-			caches.open(CACHE).then((cache) =>
-				cache.match(req).then(
-					(hit) =>
-						hit ||
-						fetch(req).then((res) => {
-							if (res.ok) cache.put(req, res.clone());
-							return res;
-						}),
-				),
-			),
-		);
-		return;
-	}
-
+	// Offline tolerance for the few endpoints the public shell needs to render
+	// at all. Network-first, so a deploy is never shadowed by this cache.
 	if (
 		url.pathname.startsWith("/api/home") ||
 		url.pathname.startsWith("/api/online") ||
@@ -61,6 +67,8 @@ self.addEventListener("fetch", (event) => {
 		return;
 	}
 
+	// Admin pages are never cached (nginx sends no-store once a session cookie
+	// is present). Always network-first; offline is the browser's call.
 	if (req.mode === "navigate") {
 		event.respondWith(fetch(req));
 	}
diff --git a/src/components/pwa-register.tsx b/src/components/pwa-register.tsx
index 6b0a6a45..44e97b47 100644
--- a/src/components/pwa-register.tsx
+++ b/src/components/pwa-register.tsx
@@ -2,7 +2,10 @@
 
 import { useEffect } from "react";
 
-const SW_VERSION = "3";
+// Must move together with the caches in public/sw.js. It is part of the
+// registration URL, so an unchanged value means the browser never refetches
+// sw.js and keeps running the previous worker.
+const SW_VERSION = "4";
 
 export function PwaRegister() {
 	useEffect(() => {