diff --git a/modules/webstack.nix b/modules/webstack.nix
index 448983b..f05aaa6 100644
--- a/modules/webstack.nix
+++ b/modules/webstack.nix
@@ -180,6 +180,7 @@
       dnsResolver = "127.0.0.1:53";
       group = "nginx";
       webroot = "/var/lib/acme/acme-challenge";
+      ocspMustStaple = true;
     };
     certs."coolneng.duckdns.org".extraDomainNames = [
       "radicale.coolneng.duckdns.org"