diff --git a/Dockerfile.prod b/Dockerfile.prod
index b3a8ecc..e87f0d1 100644
--- a/Dockerfile.prod
+++ b/Dockerfile.prod
@@ -45,6 +45,7 @@ ENV HOME=/home/app
 ENV APP_HOME=/home/app/app
 RUN mkdir $APP_HOME
 RUN mkdir $APP_HOME/static
+RUN mkdir $APP_HOME/media
 WORKDIR $APP_HOME
 
 # install dependencies
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index dd24b09..8c19d5d 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -8,6 +8,7 @@ services:
     command: gunicorn gmba_django.wsgi:application --bind 0.0.0.0:8000
     volumes:
       - static_volume:/home/app/app/static
+      - media_volume:/home/app/app/media
     expose:
       - 8000
     env_file:
@@ -24,6 +25,7 @@ services:
     build: ./nginx
     volumes:
       - static_volume:/home/app/app/static
+      - media_volume:/home/app/app/media
     ports:
       - 1337:80
     depends_on:
@@ -32,3 +34,4 @@ services:
 volumes:
   postgres_data:
   static_volume:
+  media_volume:
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 3a25edf..ceab716 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -5,6 +5,8 @@ upstream gmba_django {
 server {
     listen 80;
 
+    client_max_body_size 256m;
+
     location / {
         proxy_pass http://gmba_django;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -12,9 +14,15 @@ server {
         proxy_redirect off;
     }
 
-
     location /static/ {
         alias /home/app/app/static/;
+        expires max;
     }
 
+    location /media/ {
+        alias /home/app/app/media/;
+        expires max;
+    }
+
+    add_header Content-Security-Policy "frame-ancestors https://www.gmba.unibe.ch"
 }