diff --git a/docker/main/build_nginx.sh b/docker/main/build_nginx.sh
index 4a8ea15d45..c1ab9c90ff 100755
--- a/docker/main/build_nginx.sh
+++ b/docker/main/build_nginx.sh
@@ -4,7 +4,6 @@ set -euxo pipefail
 
 NGINX_VERSION="1.27.4"
 VOD_MODULE_VERSION="v1.9.1"
-SECURE_TOKEN_MODULE_VERSION="1.5"
 SET_MISC_MODULE_VERSION="v0.33"
 NGX_DEVEL_KIT_VERSION="v0.3.3"
 
@@ -52,11 +51,6 @@ patch -d /tmp/nginx-vod-module/ -p1 << 'EOF'
 EOF
 
 
-mkdir /tmp/nginx-secure-token-module
-wget https://github.com/kaltura/nginx-secure-token-module/archive/refs/tags/${SECURE_TOKEN_MODULE_VERSION}.tar.gz
-tar -zxf ${SECURE_TOKEN_MODULE_VERSION}.tar.gz -C /tmp/nginx-secure-token-module --strip-components=1
-rm ${SECURE_TOKEN_MODULE_VERSION}.tar.gz
-
 mkdir /tmp/ngx_devel_kit
 wget https://github.com/vision5/ngx_devel_kit/archive/refs/tags/${NGX_DEVEL_KIT_VERSION}.tar.gz
 tar -zxf ${NGX_DEVEL_KIT_VERSION}.tar.gz -C /tmp/ngx_devel_kit --strip-components=1
@@ -80,7 +74,6 @@ cd /tmp/nginx
     --add-module=../ngx_devel_kit \
     --add-module=../nginx-set-misc-module \
     --add-module=../nginx-vod-module \
-    --add-module=../nginx-secure-token-module \
     --with-cc-opt="-O3 -Wno-error=implicit-fallthrough"
 
 make CC="ccache gcc" -j$(nproc) && make install
diff --git a/docker/main/rootfs/usr/local/nginx/conf/nginx.conf b/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
index 5884a11ed5..cf9a567216 100644
--- a/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
+++ b/docker/main/rootfs/usr/local/nginx/conf/nginx.conf
@@ -143,8 +143,14 @@ http {
             # version 6 (RFC 8216 section 7); the module default is 4
             vod_hls_version 6;
 
-            secure_token $args;
-            secure_token_types application/vnd.apple.mpegurl;
+            # Pass the playlist's query args (e.g. Home Assistant's authSig) on
+            # to every URL in it. These match the only URL endings vod writes
+            # with fmp4 and no subtitles.
+            sub_filter_types application/vnd.apple.mpegurl;
+            sub_filter_once off;
+            sub_filter '.m3u8' '.m3u8$is_args$args';
+            sub_filter '.m4s' '.m4s$is_args$args';
+            sub_filter '.mp4"' '.mp4$is_args$args"';
 
             include security_headers.conf;
             add_header Cache-Control "no-store";