diff --git a/apps/openresty/1.31.1.1-2-4-noble/conf/http.d/.gitkeep b/apps/openresty/1.31.1.1-2-4-noble/conf/http.d/.gitkeep
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf b/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf
index d1aa15366fbe..e5b060c8c45a 100644
--- a/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf
+++ b/apps/openresty/1.31.1.1-2-4-noble/conf/nginx.conf
@@ -37,15 +37,15 @@ http {
     gzip_min_length  1k;
     gzip_buffers     4 16k;
     gzip_http_version 1.1;
-    gzip_comp_level 2;
-    gzip_types     text/plain application/javascript application/x-javascript text/javascript text/css application/xml;
+    gzip_comp_level 5;
+    gzip_types     text/plain text/css text/xml text/javascript application/json application/ld+json application/javascript application/x-javascript application/xml application/xhtml+xml application/rss+xml application/atom+xml application/wasm image/svg+xml font/ttf font/otf;
     gzip_vary on;
-    gzip_proxied   expired no-cache no-store private auth;
-    gzip_disable   "MSIE [1-6]\.";
+    gzip_proxied   any;
 
     limit_conn_zone $binary_remote_addr zone=perip:10m;
     limit_conn_zone $server_name zone=perserver:10m;
 
+    include /usr/local/openresty/nginx/conf/http.d/*.conf;
     include /usr/local/openresty/nginx/conf/conf.d/*.conf;
     include /usr/local/openresty/nginx/conf/default/*.conf;
     include /usr/local/openresty/1pwaf/data/conf/waf.conf;
diff --git a/apps/openresty/1.31.1.1-2-4-noble/docker-compose.yml b/apps/openresty/1.31.1.1-2-4-noble/docker-compose.yml
index bf1df68b34dc..99559e479cb1 100644
--- a/apps/openresty/1.31.1.1-2-4-noble/docker-compose.yml
+++ b/apps/openresty/1.31.1.1-2-4-noble/docker-compose.yml
@@ -19,6 +19,7 @@ services:
       - ./conf/default:/usr/local/openresty/nginx/conf/default/
       - ./conf/ssl:/usr/local/openresty/nginx/conf/ssl/
       - ./conf/modules-enabled:/usr/local/openresty/nginx/conf/modules-enabled/:ro
+      - ./conf/http.d:/usr/local/openresty/nginx/conf/http.d/:ro
       - ./modules:/usr/local/openresty/nginx/modules/1panel/:ro
       - ./log:/var/log/nginx
       - ./root:/usr/share/nginx/html
diff --git a/apps/openresty/1.31.1.1-2-4-noble/scripts/init.sh b/apps/openresty/1.31.1.1-2-4-noble/scripts/init.sh
index 494e80d096ca..c4584742c4a3 100755
--- a/apps/openresty/1.31.1.1-2-4-noble/scripts/init.sh
+++ b/apps/openresty/1.31.1.1-2-4-noble/scripts/init.sh
@@ -2,7 +2,7 @@
 
 source ./.env
 
-mkdir -p modules conf/modules-enabled
+mkdir -p modules conf/modules-enabled conf/http.d
 
 sed -i -E "s/(listen[[:space:]]+)80([[:space:]]*default_server;)/\1${PANEL_APP_PORT_HTTP}\2/" conf/default/00.default.conf
 sed -i -E "s/(listen[[:space:]]+)\[::]:80([[:space:]]*default_server;)/\1\[::]:${PANEL_APP_PORT_HTTP}\2/" conf/default/00.default.conf
diff --git a/apps/openresty/1.31.1.1-2-4-noble/scripts/upgrade.sh b/apps/openresty/1.31.1.1-2-4-noble/scripts/upgrade.sh
index f921a27ac035..6573d8c24985 100644
--- a/apps/openresty/1.31.1.1-2-4-noble/scripts/upgrade.sh
+++ b/apps/openresty/1.31.1.1-2-4-noble/scripts/upgrade.sh
@@ -1,8 +1,10 @@
 #!/bin/bash
 NGINX_CONF="conf/nginx.conf"
 MODULE_INCLUDE="include /usr/local/openresty/nginx/conf/modules-enabled/*.conf;"
+HTTP_INCLUDE="include /usr/local/openresty/nginx/conf/http.d/*.conf;"
+SITE_INCLUDE="include /usr/local/openresty/nginx/conf/conf.d/*.conf;"
 
-mkdir -p modules conf/modules-enabled
+mkdir -p modules conf/modules-enabled conf/http.d
 
 if [ ! -f "$NGINX_CONF" ]; then
     echo "✗ failed:  $NGINX_CONF not found"
@@ -13,6 +15,24 @@ if ! grep -Fq "$MODULE_INCLUDE" "$NGINX_CONF"; then
     sed -i "1i$MODULE_INCLUDE" "$NGINX_CONF"
 fi
 
+# http.d holds panel-managed http-context directives (compression, module
+# runtime settings). It must be included before conf.d so that per-site
+# configuration keeps overriding the global defaults.
+if ! grep -Fq "$HTTP_INCLUDE" "$NGINX_CONF"; then
+    if grep -Fq "$SITE_INCLUDE" "$NGINX_CONF"; then
+        awk -v site="$SITE_INCLUDE" -v http="$HTTP_INCLUDE" '
+            !done && index($0, site) {
+                match($0, /^[ \t]*/)
+                printf "%s%s\n", substr($0, 1, RLENGTH), http
+                done = 1
+            }
+            { print }
+        ' "$NGINX_CONF" > "$NGINX_CONF.tmp" && mv "$NGINX_CONF.tmp" "$NGINX_CONF"
+    else
+        echo "! skipped: conf.d include not found, add '$HTTP_INCLUDE' to the http block manually"
+    fi
+fi
+
 STREAM_BLOCK='stream {
     log_format streamlog '\''$remote_addr[$time_local] '\''
                          '\''$protocol $status $bytes_sent $bytes_received '\''