diff --git a/birdnet-pipy/CHANGELOG.md b/birdnet-pipy/CHANGELOG.md
index 1a05ef9224..d76eba7fbb 100644
--- a/birdnet-pipy/CHANGELOG.md
+++ b/birdnet-pipy/CHANGELOG.md
@@ -1,4 +1,8 @@
  
+## 0.8.2-1 (2026-07-04)
+- Fix nginx failing to start with `limit_req_zone "api_rl" already bound` (502 on every page, Suncuss/BirdNET-PiPy#59). Upstream 0.8.2 added http-level rate-limit zones, and the ingress config was generated as a full copy of nginx.conf — duplicating those declarations in the shared http context. `ingress.conf` is now built from the `server` block only, so http-level directives stay declared once.
+- Comment out the new upstream Content-Security-Policy header in ingress mode, matching the existing X-* security-header handling (ingress runs inside Home Assistant's authenticated frame; direct access keeps the full CSP).
+
 ## 0.8.2 (2026-07-04)
 - Update to latest version from Suncuss/BirdNET-PiPy (changelog : https://github.com/Suncuss/BirdNET-PiPy/releases)
  
diff --git a/birdnet-pipy/config.yaml b/birdnet-pipy/config.yaml
index ff471c103d..8b0968a53d 100644
--- a/birdnet-pipy/config.yaml
+++ b/birdnet-pipy/config.yaml
@@ -96,4 +96,4 @@ schema:
   ssl: bool?
 slug: birdnet-pipy
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pipy
-version: "0.8.2"
+version: "0.8.2-1"
diff --git a/birdnet-pipy/rootfs/etc/cont-init.d/32-nginx_ingress.sh b/birdnet-pipy/rootfs/etc/cont-init.d/32-nginx_ingress.sh
index ee2f73b4a3..50e9355af0 100755
--- a/birdnet-pipy/rootfs/etc/cont-init.d/32-nginx_ingress.sh
+++ b/birdnet-pipy/rootfs/etc/cont-init.d/32-nginx_ingress.sh
@@ -24,11 +24,18 @@ if ! [[ "${ingress_port}" =~ ^[0-9]+$ ]] || [[ "${ingress_port}" -le 0 ]]; then
     exit 0
 fi
 
-cp /etc/nginx/servers/nginx.conf /etc/nginx/servers/ingress.conf
+# Build the ingress server from the server block ONLY. Both files in
+# servers/ are included into one http context, so http-level directives
+# (map, limit_req_zone, ...) must stay declared once, in nginx.conf — a
+# duplicated limit_req_zone is a fatal "already bound" error and nginx
+# never starts (502 on every page). Upstream keeps all http-level
+# directives above its single column-0 "server {".
+sed -n '/^server {/,$p' /etc/nginx/servers/nginx.conf > /etc/nginx/servers/ingress.conf
 sed -i \
     -e "s|listen 80;|listen ${ingress_interface}:${ingress_port} default_server;|g" \
     -e "/index index.html;/a\\    include /etc/nginx/includes/ingress_params.conf;" \
     -e 's|^[[:space:]]*add_header X|#&|g' \
+    -e 's|^[[:space:]]*add_header Content-Security-Policy|#&|g' \
     /etc/nginx/servers/ingress.conf
 
 sed -i "s#%%ingress_entry%%#${ingress_entry}#g" /etc/nginx/includes/ingress_params.conf