diff --git a/deployment/docker/nginx.conf b/deployment/docker/nginx.conf
index b37896c9bb..875d4901dc 100644
--- a/deployment/docker/nginx.conf
+++ b/deployment/docker/nginx.conf
@@ -48,6 +48,14 @@ http {
             expires 7d;
             access_log off;
         }
+        location ^~ /media/cachedfiles {
+            deny all;
+            return 404;
+        }
+        location ^~ /media/invoices {
+            deny all;
+            return 404;
+        }
         location /static/ {
             alias /static/;
             access_log off;
diff --git a/doc/admin/installation/manual_smallscale.rst b/doc/admin/installation/manual_smallscale.rst
index 2b2284f7ae..8f9bcda712 100644
--- a/doc/admin/installation/manual_smallscale.rst
+++ b/doc/admin/installation/manual_smallscale.rst
@@ -153,7 +153,7 @@ named ``/etc/systemd/system/pretix-web.service`` with the following content::
                           --name pretix --workers 5 \
                           --max-requests 1200  --max-requests-jitter 50 \
                           --log-level=info --bind=127.0.0.1:8345
-    WorkingDirectory=/var/pretix/source/src
+    WorkingDirectory=/var/pretix
     Restart=on-failure
 
     [Install]
@@ -171,7 +171,7 @@ For background tasks we need a second service ``/etc/systemd/system/pretix-worke
     Environment="VIRTUAL_ENV=/var/pretix/venv"
     Environment="PATH=/var/pretix/venv/bin:/usr/local/bin:/usr/bin:/bin"
     ExecStart=/var/pretix/venv/bin/celery -A pretix.celery_app worker -l info
-    WorkingDirectory=/var/pretix/source/src
+    WorkingDirectory=/var/pretix
     Restart=on-failure
 
     [Install]
@@ -226,6 +226,15 @@ The following snippet is an example on how to configure a nginx proxy for pretix
             access_log off;
         }
 
+        location ^~ /media/cachedfiles {
+            deny all;
+            return 404;
+        }
+        location ^~ /media/invoices {
+            deny all;
+            return 404;
+        }
+
         location /static/ {
             alias /var/pretix/source/src/pretix/static.dist/;
             access_log off;