diff --git a/nginx/nginx_readonly.conf b/nginx/nginx_readonly.conf
index 1251cf46f..2f7e770d6 100644
--- a/nginx/nginx_readonly.conf
+++ b/nginx/nginx_readonly.conf
@@ -129,6 +129,16 @@ http {
       proxy_set_header Host file-monitor.malcolm.local;
     }
 
+    # extracted file download hedgehog redirect
+    location ~* ^/hh-extracted-files/([a-zA-Z0-9-\.]+)\b(.*) {
+      set $upstream $1:8006;
+      rewrite ^/hh-extracted-files/([a-zA-Z0-9-\.]+)(.*)$ $2 break;
+      proxy_pass https://$upstream;
+      proxy_ssl_verify off;
+      proxy_set_header Host $1;
+      proxy_set_header X-Malcolm-Forward "/hh-extracted-files/$1";
+    }
+
     # netbox
     location /netbox {
       limit_except GET { deny all; }