diff --git a/roles/nginx/files/snippets/no-unsafe-files.conf b/roles/nginx/files/snippets/no-unsafe-files.conf
index 6f00246..5a6df31 100644
--- a/roles/nginx/files/snippets/no-unsafe-files.conf
+++ b/roles/nginx/files/snippets/no-unsafe-files.conf
@@ -1,4 +1,4 @@
-disable_symlinks on from=$document_root;
+disable_symlinks if_not_owner from=$document_root;
 
 # Do not serve dotfiles.
 location ~ /\. {