diff --git a/backend/api/invoices.py b/backend/api/invoices.py
index ac10d48..edc4879 100644
--- a/backend/api/invoices.py
+++ b/backend/api/invoices.py
@@ -6,7 +6,7 @@ from datetime import date, timedelta
 from decimal import Decimal
 from typing import Optional
 
-from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, BackgroundTasks
+from fastapi import APIRouter, Depends, HTTPException, Request, UploadFile, File, BackgroundTasks
 from fastapi.responses import FileResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select, func, text
@@ -1233,17 +1233,25 @@ async def get_invoice_image(
 @router.get("/{invoice_id}/file")
 async def get_invoice_file(
     invoice_id: int,
-    token: str,
+    request: Request,
+    token: Optional[str] = None,
     db: AsyncSession = Depends(get_db)
 ):
-    """Get invoice file (image or PDF) with token in query param - works through proxies"""
+    """Get invoice file (image or PDF) — supports both cookie auth and ?token= JWT"""
     from starlette.responses import Response
     from services.file_archival_service import FileArchivalService
 
-    # Verify token and get user
-    current_user = await get_current_user_from_token(token, db)
+    # Try JWT token param first, fall back to hnf_session cookie
+    current_user = None
+    if token:
+        current_user = await get_current_user_from_token(token, db)
     if not current_user:
-        raise HTTPException(status_code=401, detail="Invalid token")
+        try:
+            current_user = await get_current_user(request)
+        except HTTPException:
+            pass
+    if not current_user:
+        raise HTTPException(status_code=401, detail="Authentication required")
 
     invoice = await get_invoice_or_404(invoice_id, current_user, db)
 
@@ -1282,17 +1290,23 @@ async def get_invoice_file(
 @router.get("/{invoice_id}/pdf")
 async def get_invoice_pdf(
     invoice_id: int,
-    token: str,
+    request: Request,
+    token: Optional[str] = None,
     db: AsyncSession = Depends(get_db)
 ):
-    """Get invoice PDF with token in query param (for iframe embedding) - DEPRECATED, use /file"""
-    from auth import get_current_user, require_cap_from_token
+    """Get invoice PDF — DEPRECATED, use /file"""
     from starlette.responses import Response
 
-    # Verify token and get user
-    current_user = await get_current_user_from_token(token, db)
+    current_user = None
+    if token:
+        current_user = await get_current_user_from_token(token, db)
     if not current_user:
-        raise HTTPException(status_code=401, detail="Invalid token")
+        try:
+            current_user = await get_current_user(request)
+        except HTTPException:
+            pass
+    if not current_user:
+        raise HTTPException(status_code=401, detail="Authentication required")
 
     invoice = await get_invoice_or_404(invoice_id, current_user, db)
 
diff --git a/frontend/nginx.conf b/frontend/nginx.conf
index 9e2e0cf..d1baa23 100644
--- a/frontend/nginx.conf
+++ b/frontend/nginx.conf
@@ -1,3 +1,8 @@
+types {
+  text/javascript  js mjs;
+  application/pdf  pdf;
+}
+
 server {
   listen 80;
   server_name _;